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CHARTING A PATH FORWARD FOR 
THE CHEMICAL FACILITIES ANTI-TERRORISM 
STANDARDS PROGRAM 


WEDNESDAY, MAY 14, 2014 

U.S. Senate, 

Committee on Homeland Security 
AND Governmental Aefairs, 

Washington, DC. 

The Committee met, pursuant to notice, 10:01 at a.m., in room 
SD-342, Dirksen Senate Office Building, Hon. Thomas R. Carper, 
Chairman of the Committee, presiding. 

Present: Senators Carper, Levin, Landrieu, Coburn, and John- 
son. 


OPENING STATEMENT OF CHAIRMAN CARPER 

Chairman Carper. The hearing will come to order. I want to wel- 
come everybody for coming today. I am going to make a very short 
statement, and then turn it over to Dr. Coburn. 

This program that was needed is a program that did not start 
well, had all kinds of problems, as you know. And I think the De- 
partment of Homeland Security (DHS) deserves some credit, a good 
deal of credit, for taking a program not well run and making it a 
whole lot better. There are a lot of folks that have been part of 
that, not just at DHS, but we commend you there. 

We also know everything we do we can do better, and we still 
need to do better here. I have some concerns, and we will talk 
about those. I know Dr. Coburn has some concerns. But I think we 
have the prospect here today for a very constructive hearing that, 
if done well and with good followup, would enable us to hopefully 
move forward with a reauthorization bill. And we need that be- 
cause we have not had authorization for quite a while, and there 
are problems. 

When the government shuts down, we have a real problem with 
this program without the lack of an authorization bill, so thank you 
all for coming. I am looking forward to a really constructive hear- 
ing. 

We are going to have, unfortunately, a series of votes that start 
about 11:15, but Dr. Coburn and I have been practicing on how one 
of us stays, the other goes, and we swap back and forth and keep 
things moving. So my goal is to hopefully be finished with the first 
panel by maybe about 11:30 or so, and then we will bring on our 
second panel. Dr. Coburn. 


( 1 ) 
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OPENING STATEMENT OF SENATOR COBURN 

Senator Coburn. Well, good morning and welcome to you, David. 
I did not get to say greetings. I did to Suzanne and Stephen. 

I want to tell you how enthused I am with the leadership at DHS 
and the changes that are occurring, and congratulate you both in 
terms of your Secretary but also in terms of the improvements that 
are being made. And I mean that very sincerely. 

But one of the programs that deserves a robust review is the 
Chemical Facility Anti-Terrorism Standards (CFATS). Since 2007 
we have spent $600 million on the program, and less than 2 per- 
cent of the facilities have been inspected for compliance. And in my 
review, I have learned some things: 

One is that CFATS is not significantly reducing the risk that ter- 
rorists will use chemicals to conduct attacks against the United 
States. 

The second thing I have learned is that the approach to assess- 
ing risk in chemical facilities which guides the CFATS program is 
broken. We will go into that in the questions. 

Third, DHS is far behind in meeting its deadlines in this pro- 
gram, reviewing security plans, and inspecting facilities. That is 
not to say that David has not made a lot of progress. He has, and 
I congratulate him on it. 

My fourth criticism is there is not enough work with the private 
sector or security efforts to fix the problems in the programs, and 
my feeling is that we need to fix it before we make it permanent, 
and that is what I intend to do. 

I wanted to give you a little visual. Here are the requirements 
for a company that has to meet the Coast Guard’s Maritime Trans- 
portation Security Act (MTSA) program. Here are the requirements 
if you have to meet the Transportation Security Administration 
(TSA) Pipeline Security Branch guidance. Here is what is required 
if you have to meet the U.S. Environmental Protection Agency 
(EPA’s) Risk Management Program. And here is what you have to 
fill out if you are one of the 41,000 facilities regulated by CFATS. 
And then if you are one of the 4,100, besides filling that out, you 
have to fill this out. It cannot be that complicated. As a matter of 
fact, talking to industry, which I have, it is not that complicated. 

So one of the reasons it is hard to fix is because we have put all 
this gobbledygook that has no attendant impact on what we are 
doing. So if you take all three of these programs — EPA’s, TSA’s, 
and the Coast Guard’s — it does not even come close to what the re- 
quirements are for a chemical facility. And then if you are one at 
high risk that is covered by CFATS you have to spend 214 times 
more than that. 

We have to look at this program. We have to fix it. It is an im- 
portant thing that we need to do. We need to solve the problems. 
I look forward to your testimony, and I thank you for being here. 

Chairman Carper. All right. That is a good note to start on, isn’t 
it? We have our work cut out for us. 

One thing, I am not going to introduce our witnesses. You have 
been with us before. We are happy that you are with us again, and 
we appreciate your preparation. 
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Some of our colleagues will wander in and out during the course 
of this morning, and we will just identify people and recognize 
them as time allows. 

Please proceed. We had Department of Defense (DOD) here with 
us yesterday. Dr. Coburn and I worked them over for a couple of 
hours with our colleagues to try to figure out how they could do 
what you have done at DHS, and that is, to be not just auditable 
but also to get a clean financial audit in record time. And if DHS 
can do that with aplomb, then DOD should as well. In the entire 
testimony that they gave us, only one of them used an acronym, 
and I would just say that is a high standard to set for DOD to be 
able to do that sort of thing, so the Federal Bureau of Investiga- 
tions (FBI), the Central Intelligence Agency (CIA), EPA, those are 
fine, but the other stuff? Stay away from it. Just stay away from 
it. Your job is to try to explain stuff. My job, our job, is to try to 
understand it. So just do not use acronyms. Thank you. 

Ms. Spaulding, you are recognized. Thank you for joining us. 

TESTIMONY OF THE HON. SUZANNE E. SPAULDINGJ UNDER 

SECRETARY, NATIONAL PROTECTION AND PROGRAMS DI- 
RECTORATE, U.S. DEPARTMENT OF HOMELAND SECURITY 

Ms. Spaulding. Thank you very much, Mr. Chairman, and we 
will certainly try to meet that high bar. 

I very much appreciate. Chairman Carper and Ranking Member 
Coburn, the opportunity to be here this morning to discuss the 
Chemical Facility Anti-Terrorism Standards program, fostering se- 
curity at America’s highest-risk chemical facilities. 

Our testimony today focuses on the progress the program has 
made, our efforts to continue strengthening the program, and the 
need for permanent authorization to fully stabilize this program. 

Two years ago, DHS had not approved a single security plan. 
Today that number is 764. Two years ago, DHS had not completed 
a single compliance inspection. The first compliance inspections 
began last September, and today that number is 31, and our in- 
spectors have conducted over 1,000 authorization inspections. 

Ninety-eight percent of Tier 1 facilities have an approved secu- 
rity plan; 66 percent of Tier 2 facilities and 39 percent of Tier 3 
facilities have an approved plan. We are sustaining an average rate 
of more than 80 approvals each month, which would cut in half the 
Government Accountability Office (GAO’s) estimate of how long it 
would take to clear the backlog of plan approvals. 

Approximately 75 percent of these facilities’ plans included meas- 
ures recommended by DHS or the facility as necessary upgrades in 
order to satisfy the applicable Risk-Based Performance Standards. 
This is significant progress. It is a testament to the dedicated team 
at the Infrastructure Security and Compliance Division (ISCD), the 
program reforms they have put in place, and their efforts to work 
every day with our partners in the private sector and in govern- 
ment to put this program on a stable path. 

That work continues. We continue to engage with stakeholders 
and focus on three core areas to strengthen the program: first, re- 
ducing the backlog; two, improving the risk assessment process; 


^The prepared statement of Ms. Spaulding appears in the Appendix on page 47. 
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and, three, ensuring that all potentially high-risk facilities are 
identified. Along with long-term authorization, our continued focus 
on these areas will ensure our stakeholders have the stability they 
need to successfully comply with their regulatory obligations. We 
welcome the opportunity to work with you and our stakeholders on 
these important issues. 

First, the backlog. Successful efforts to streamline the approval 
process include encouraging increased use of Alternative Security 
Programs (ASP) and supporting industry stakeholders’ develop- 
ment of new templates, focusing inspections on key Risk-Based 
Performance Standards at our lower- tier facilities, and working at 
the corporate level to identify efficiencies. 

At the same time we will maintain the quality and thoroughness 
of the security plan approval process and the level of security re- 
quired at chemical facilities. 

Improving the risk assessment process. DHS has conducted a 
thorough review of the CFATS risk assessment process. We have 
documented the risk assessment methodology, conducted an inter- 
nal review of the risk assessment process, and initiated an external 
peer review. 

All three of these phases are now complete. We have analyzed 
the peer review recommendations and developed an implementa- 
tion plan to enable us to address their recommendations in a time- 
ly and thoughtful manner. We also recognize that it is essential to 
continue to engage with stakeholders as we assess changes to the 
risk assessment process. We intend to adopt appropriate changes 
to the tiering methodology in an integrated fashion, addressing as 
many issues concurrently as we possibly can, to balance improve- 
ments to the methodology with our stakeholders’ need for stability. 

Following the tragic explosion in West, Texas, just over a year 
ago, DHS has taken a number of steps to ensure that facilities are 
aware of their reporting obligations under CFATS. As you know, 
that incident led the President to issue an Executive Order (EO) 
on chemical safety and security with DHS as a co-chair of the im- 
plementation group. That group will provide recommendations to 
the President to improve information collection, more effectively 
share information between agencies, improve operational and Eed- 
eral coordination efforts, and improve the effectiveness of existing 
policies governing chemicals and chemical facilities. 

In addition to enhanced coordination with Eederal, State, and 
local partners, these efforts will help ensure that the Eederal Gov- 
ernment most effectively uses its collective resources for managing 
chemical facility risk. 

Einally, the Department strongly believes that long-term author- 
ization would be beneficial to your oversight activities by ensuring 
the full maturation of the program and the review and approval of 
backlogged Site Security Plans (SSPs). Efforts to codify and en- 
hance this authority to seek out noncompliant facilities will also 
greatly support our ongoing actions to bring those facilities into 
compliance. And perhaps most importantly, long-term authoriza- 
tion will provide industry stakeholders with the stability they need 
to plan for and invest in CEATS security-related measures. An au- 
thorization period of 5 years or longer would also enable Congress 
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to send an important message to facilities that may willfully be 
seeking to avoid compliance. 

In conclusion, Mr. Chairman, I am proud of the progress we have 
made and the efforts we are taking to secure America’s highest-risk 
facilities. We are committed to working with you to pass legislation 
to authorize the program. CFATS is making the Nation more se- 
cure by reducing the risks associated with our Nation’s chemical in- 
frastructure, and we along with our stakeholders and partners are 
committed to its continued success. 

Thank you for the opportunity to testify today, and I look for- 
ward to answering your questions. 

Chairman Carper. We appreciate that opening statement, and 
we look forward to hearing now from Mr. Wulf. Please proceed. 

TESTIMONY OF DAVID M. WULFP DIRECTOR, INFRASTRUC- 
TURE SECURITY COMPLIANCE DIVISION, OFFICE OF INFRA- 
STRUCTURE PROTECTION, NATIONAL PROTECTION AND 

PROGRAMS DIRECTORATE, U.S. DEPARTMENT OF HOME- 
LAND SECURITY 

Mr. Wulf. Thank you. Chairman Carper, Senator Coburn and 
Members of the Committee. I appreciate the opportunity to testify 
before you today to provide an update on the progress of the Chem- 
ical Facility Anti-Terrorism Standards program, the progress the 
CFATS program has made, and to discuss the prospect of long-term 
authorization for this important anti-terrorism program that fos- 
ters security at America’s highest-risk chemical facilities. 

Earlier this week, our program reached a new milestone as I had 
the privilege of granting final approval of the 750th Site Security 
Plan that has been approved under CFATS, a security plan belong- 
ing to a small chemical distributor in the Midwest. While there cer- 
tainly remains more to do, the Department, including our Infra- 
structure Security Compliance Division, is continuing the forward 
momentum the CFATS program has experienced over the past 2 
years. 

The pace of authorizations and approvals is increasing consist- 
ently. Through much hard work on the part of our staff and indus- 
try stakeholders, we have since September, just 8 months ago, 
more than tripled the number of Site Security Plans that have at- 
tained final approval. As I noted, that number now stands at more 
than 750 with more than 1,500 facilities having attained authoriza- 
tion of their Site Security Plans. 

The CFATS program has matured tremendously over the past 2 
years as we have addressed the challenges described in the inter- 
nal memorandum and associated action plan that was developed in 
the fall of 2011. We have developed improved policies, procedures, 
and training to ensure that inspections are conducted in a con- 
sistent and thorough fashion. We have implemented an effective, 
streamlined Site Security Plan review process, a process that has 
greatly enhanced our ability to authorize and, as appropriate, grant 
final approval for Site Security Plans. 

We have also done much to stabilize our leadership cadre by hir- 
ing permanent seasoned managers, and we continue to foster 


^The prepared statement of Mr. Wulf appears in the Appendix on page 47. 
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transparency and open communication throughout the organiza- 
tion. I would like to recognize our workforce, which truly has a pas- 
sion for the mission of chemical facility security, and is on the joh 
every day working hard in concert with our industry stakeholders 
to foster security for America’s highest-risk chemical infrastruc- 
ture. 

Our pace of inspections, reviews, and approvals will increase fur- 
ther as we continue to achieve efficiencies and to implement game- 
changing initiatives to streamline our processes and to work with 
stakeholders. I expect to continue to conduct inspections at a rate 
of more than 100 per month and to continue authorizing and ap- 
proving security plans while moving further into a regular cycle of 
compliance inspection activity. 

Among other game-changing measures, we are assigning cor- 
porate case managers, inspectors who are working directly with 
companies that operate multiple CFATS facilities and which fre- 
quently have corporate policies and practices that are consistent 
company-wide in an effort to further streamline the inspection and 
approval process for those facilities. 

I have testified before this and other Congressional Committees 
10 times in the past 2 years, and I have not heen hesitant to high- 
light the challenges that have faced our program. I am pleased to 
tell you today, however, that this program is in a far different and 
much better place than it was 2 years ago. It is a program that 
truly has moved to the next level and that could benefit tremen- 
dously from the stability that would come with a long-term or per- 
manent authorization. 

In view of the significant forward progress CFATS has made, it 
is appropriate that Congress is considering authorizing the pro- 
gram on a long-term basis. Long-term authorization will provide in- 
dustry with the certainty it needs to plan for and invest in CFATS- 
related security measures, and it will provide the Department with 
the ability to continue to recruit and retain top talent and continue 
planning and executing improvements to move the program for- 
ward. 

It will also reduce the possibility of another lapse in authority 
such as occurred during October’s government shutdown. In addi- 
tion to the confusion this situation created among industry stake- 
holders, had the need arisen for the Department to take enforce- 
ment action to address a national security threat at a CFATS facil- 
ity during the period of this lapse, the underlying statutory author- 
ity for such enforcement action would have been in doubt. This is 
not a situation anyone wants to see repeated. 

Our chemical security inspectors are today providing compliance 
assistance to facilities and conducting inspections at an unprece- 
dented rate, and I am pleased to report that I have received much 
favorable feedback from our industry stakeholders about their ex- 
perience with these inspections. As you know — and this is some- 
thing for which I am profoundly grateful — our stakeholders are not 
shy when it comes to expressing their candid thoughts and con- 
cerns about the program. So I am confident that when I am hear- 
ing positive things from industry about their facilities’ inspections- 
related experiences, we are on the right track. 
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You will hear from one such individual today, Tim Scott, rep- 
resenting Dow Chemical Company and the American Chemistry 
Council. A number of industry organizations have been instru- 
mental in promoting the continued forward progress of CFATS. 
The American Chemistry Council has been a leader in the develop- 
ment of an Alternative Security Program template and, along with 
organizations such as the Society of Chemical Manufacturers and 
Affiliates, the National Association of Chemical Distributors, the 
American Fuel and Petrochemical Manufacturers, and many oth- 
ers, has for years played a critical role in educating chemical com- 
panies about CFATS and other regulatory and voluntary programs 
that foster chemical facility security. 

So thank you again for the opportunity to provide an update on 
the forward progress the CFATS program continues to make. It is 
an honor and a privilege to serve with the dedicated professionals 
of the Infrastructure Security Compliance Division and the Na- 
tional Protection and Programs Directorate (NPPD). We are com- 
mitted 100 percent to the critical mission of securing our Nation’s 
highest-risk chemical infrastructure. Along with the rest of our 
team, I am excited and optimistic about the future of the CFATS 
program. 

Thank you again for the opportunity to be here today. I look for- 
ward to any questions you may have. 

Chairman Carper. Good. Thanks. And let me just say you two 
have done a great job on those acronyms, too. 

Mr. WULF. Well, thank you. 

Chairman Carper. All right. Mr. Caldwell, please. 

TESTIMONY OF STEPHEN L. CALDWELL, i DIRECTOR, HOME- 
LAND SECURITY AND JUSTICE, U.S. GOVERNMENT AC- 
COUNTABILITY OFFICE 

Mr. Caldwell. Chairman Carper and Ranking Member Coburn 
as well as Senator Landrieu and Senator Johnson, thank you very 
much for inviting GAO to discuss chemical security at the hearing 
today, especially about the path forward and potential reauthoriza- 
tion for the CFATS program. My written statement summarizes 
the work we did in 2012 and 2013 with some updates with the De- 
partment that we did in 2014, and I will summarize four key areas: 
identifying the chemical facilities, assessing the risks and 
prioritizing those facilities, reviewing Site Security Plans, and in- 
specting facilities for compliance. 

Based on the updates that we have had in our work, as well as 
through the hearing today, there are indications of progress in all 
of the four areas that I mentioned. 

Regarding the identification of facilities, the April 2013 explosion 
of the fertilizer factory in West, Texas, raised concerns about 
outliers, which are facilities that never reported to DHS but should 
have. On August 1, as has been mentioned, the President issued 
Executive Order, 13650, to address this issue, which calls for a 
working group to improve Federal, State, and local coordination for 
security and safety of chemical facilities and to, among other 


^The prepared statement of Mr. Caldwell appears in the Appendix on page 55. 
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things, identify additional facilities that, once identified, if appro- 
priate, would be subject to regulation such as through CFATS. 

DHS reports on that and the working group is supposed to report 
back to the White House at the end of May. And in Ms. Spaulding’s 
budget testimony 2 weeks ago, she noted the request for additional 
resources that will be used for data matching between databases 
at CFATS, EPA, and the Occupational Safety and Health Adminis- 
tration (OSHA), and perhaps State and local databases as well. 
From our own data-matching efforts, we know that this is an inten- 
sive process from both the technology and from a labor standpoints. 

Regarding the assessment of risk and the prioritization of facili- 
ties, DHS is working to implement our prior recommendations on 
this risk management methodology. As was mentioned, they tasked 
the Homeland Security Studies and Analysis Institute to conduct 
an internal review of their methodology. They completed that re- 
view in October 2013, and the results were pretty similar to what 
we found in April 2013. So we feel that our finding has been vali- 
dated, and the Department now has an implementation plan. We 
have not reviewed that plan yet, but we look forward to reviewing 
that plan. 

Regarding the review and the approval of Site Security Plans, 
our earlier report noted a cumbersome review process and a long 
backlog. As has just been reported, DHS reports streamlining the 
processes for CFATS, and the statistics this month indicate they 
have approved more than 700 security plans. That is about 18 to 
20 percent of the 4,000 facilities covered by CFATS. Given that per- 
centage, our upcoming review will certainly look at those approv- 
als, and we will revisit our earlier estimate, which said it would 
be 7 to 9 years to resolve the backlog. 

But the outstanding issue for all of the facilities and one we have 
made almost no progress since GAO started reviewing the program 
is the personnel surety issue. All of these plans that have been ap- 
proved at the site level have been conditionally approved because 
there is still no resolution to Performance Standard 12, which is on 
personnel surety. So until this is resolved, none of the Site Security 
Plans actually have achieved final approval. Our understanding is 
that this rule is under consideration at the Office of Management 
and Budget (0MB) and has been for some time. That is the one 
area where we would like to see progress, and I think the Depart- 
ment would like to see progress on that as well. 

Regarding the inspection of facilities for compliance, DHS now 
reports they have started that, which is the final part of this proc- 
ess. This month they gave us an estimate that they had completed 
29 of these to date. At the time of our last in-depth audit, we had 
not looked at any of those because they had not started. As part 
of our upcoming review, this will be one of the new areas that we 
will look at to see how that is going. 

In closing, I would like to note that GAO still needs to verify a 
lot of this progress through in-depth audit, and we plan to do so. 
We have a mandate from the Appropriations Committees as well 
as at least one request from the House side from the authorizers 
to continue our audits. 

So with that, I will be happy to respond to any questions. 

Chairman Carper. Great. Thanks so much, Mr. Caldwell. 
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As I mentioned to Dr. Coburn, I am prepared to yield my time 
to the Senator from Louisiana. Great to see you. And then I will 
just turn it over to Dr. Coburn, Senator Johnson, Senator Levin, 
and then I will ask some questions of my own. Nice to see you. 
Senator Landrieu. 

OPENING STATEMENT OF SENATOR LANDRIEU 

Senator Landrieu. Thank you, Mr. Chairman. I really appreciate 
the courtesy because I have to slip out, and I thank the Chairman. 
And I know we have votes at 11:15, so let me get right to it. 

As the Chair of the Appropriations Committee for Homeland Se- 
curity, I have been funding or our Committee has been funding this 
program without authorization now for several years because we 
know how important it is. 

Let me begin by saying that I am proud of the chemical industry 
in our State. It employs 26,000 people directly and tens of thou- 
sands of people indirectly. It is a very vital industry, Mr. Chair- 
man, not just to Louisiana but to your State, of course, and to other 
places in this country. 

In addition, not only is it vital to creating high-paying middle- 
class jobs that are very skilled and highly technical, but we are in 
a boom cycle because of the finding of natural gas. Natural gas is 
used as a feedstock, so getting these regulations efficient and cor- 
rectly, both for safety and also for efficient permitting of these fa- 
cilities so they can continue to grow is absolutely essential. 

If I am correct, a few years ago we had a 9-year backlog or an 
8-year backlog. Is that correct, Ms. Spaulding? 

Ms. Spaulding. Senator, GAO’s estimate was a 7-to 9-year back- 
log. We believe we are now sustaining a rate that would cut that 
time in half to get through the backlogs. 

Senator Landrieu. But it is still too long. I mean, Mr. Chairman, 
this is still too long. And I know. Senator Coburn, you agree with 
this. 

So I am going to be focused on this line item in our appropria- 
tions bill and ask my Ranking Member to really focus on what we 
can do to help here. But I think the authorizers could give us some 
good direction on this, and so I am looking forward to hearing from 
the authorizers about how they would like to move forward. But we 
have an opportunity to create literally thousands of jobs. This per- 
mitting has to go quickly, of course. The facilities have to be safe. 

So I will just leave it at that and just submit a question to the 
record, Mr. Chairman, since you have been so gracious, that the 
Personnel Surety Program must be implemented in a way that 
does not hurt thousands of contractors that are working every day 
on these facilities. I was encouraged to see the suggestion, a new 
implementation procedure that took some of the initial comments. 
What is the timeline for completion and implementation of that 
rule? And what is the nature of the feedback that you are getting? 

Now, to respect the Committee, why don’t you just submit that 
to me in writing? And then they can proceed with their questions. 

Senator Landrieu. Mr. Chairman, thank you very much, and I 
look forward to working with you and Senator Coburn as we move 
forward. 
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Chairman Carper. You bet. A great opportunity for the author- 
izers and the appropriators to work together in yet other venues, 
so that is great. Thank you. Dr. Coburn. 

Senator Coburn. So let me summarize what I have heard, and 
you all correct me if I am wrong. You have 750 Site Security Plans 
approved? 

Mr. WULF. That is right. It is a little more than 760. 

Senator Coburn. So that means there are still 3,200 that have 
not been approved. 

Mr. WuLF. Yes, there are approximately 3,200 that have received 
final tiers, about 4,000 in the entire universe. 

Senator Coburn. But they still have not been approved. 

Mr. WULF. That is correct. 

Senator Coburn. All right. And you are going to do 100 inspec- 
tions a month. 

Mr. WULF. That is correct. 

Senator Coburn. Right. So we are still 3 years from getting ev- 
erybody inspected. And I made my point on the paperwork require- 
ment. Somebody ought to review that. 

Secretary Spaulding, one of the questions I have for you — you do 
not have to respond to it, but I would like an analysis from your 
office of here is what the peer review said and here is what we 
have done in response to the peer review because it was valuable. 

Mr. Wulf, the first problems with the risk assessment in DHS 
was found in 2011, before you got there. 

Mr. Wulf. Yes. 

Senator Coburn. The GAO identified problems with it again in 
2013, and then the peer review found the same problem again. 
Why haven’t we fixed the assessment process? 

Mr. Wulf. Well, we are in the process of implementing improve- 
ments to the risk-tiering methodology. Much of what the peer re- 
view panel found and observed we also had noted through our own 
internal documentation of the methodology and our own internal 
Department review of the methodology. So we are, moving forward 
aggressively to look at how we can more fully incorporate consider- 
ations of vulnerability and threat into the risk-tiering methodology. 

The peer review panel did validate that consequence is an appro- 
priate driver of tiering. Our model right now is very heavily fo- 
cused on consequence. The model can certainly be improved. We 
are committed to improving it. And as the Under Secretary noted, 
we are going to move forward to do that in a way that balances 
the need for improvement with the need for industry to have some 
measure of stability in our risk tiering. 

Senator Coburn. One of the things you have in risk tiering is the 
location, the State. Each State has a different one. Let us take 
Kansas City, for example. If you are in Kansas City, Kansas, you 
have a different rating than if you are in Kansas City, Missouri. 
Correct? 

Mr. Wulf. That 

Senator Coburn. And you may be 2 miles away from each other. 

Mr. Wulf. Yes. 

Senator Coburn. That does not make sense. Would you agree? 
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Mr. WULF. I would agree, and we will be looking to enhance the 
granularity with which we assess threat in the tiering method- 
ology, absolutely. 

Senator Coburn. One of the things that I have noted, having 
been a manufacturer at one time — and I am not going to list these 
specifically, but we have a number of explosive precursors that are 
not on your list. I have 12 sitting in front of me. And my question 
is, and I will give this to you: Why not? 

And so what I cannot understand is why they were not included 
in the first place. Can you give me any history on that? 

Mr. WuLF. Well, the CFATS regulation was directed to be put 
into place within, I think, a 6-month period by Congress when the 
initial authority was 

Senator Coburn. Seven years ago. 

Mr. WuLF. Seven years ago, that is correct. So, I think it was 
some good work. I will not say that there is not room for improve- 
ment in that list, and we are anticipating in the very near future 
issuing an Advanced Notice of Proposed Rulemaking to open up the 
entirety of the CFATS regulation to comment and suggestions from 
our stakeholders and other interested parties for improvement. 
That will include the Appendix A list of chemicals of interest. So 
if there are additional chemicals that should be added, adjustments 
that should occur in the screening threshold quantities, et cetera, 
this is the opportunity to get that done. 

Senator Coburn. And some that should be removed. 

Mr. WuLF. Conceivably. 

Senator Coburn. Yes. 

Mr. WULF. Conceivably. But our assessment now is, given our 
current authority, that is something that has to occur through the 
rulemaking process. 

Senator Coburn. One question for you. Are there any chemical 
plants right now that are considered higher risk than what they 
are just because they are on the wrong side of a State border? Is 
somebody falling into this tougher tier because they happen to be 
in a State with a high threat score, but, they are not really at a 
higher risk? 

Mr. WULF. The model is largely consequence driven, so not driv- 
en very heavily by the threat variable, so that is another of the 
things we are looking at. So I would say that is very unlikely. 

Senator Coburn. I have some significant chemical distributors in 
Oklahoma, and when I talk with them about the paperwork load — 
and they are small businesses — and one of the things that bothers 
me is the regulatory cost for a smaller chemical distributor versus 
a large one. And what we are doing — with the amount of paper- 
work and the compliance costs for a small firm — we are going to 
drive the small firms out of business. 

Now, the larger firms here do not care about that. As a matter 
of fact, the large firms routinely use the Federal Government to en- 
hance their capability toward oligopolies. Where is your concern 
with that? What do we do about that? How do we make it easier, 
even though they might have, appropriate chemicals that need to 
be safeguarded against their use for terrorism? 

Ms. Spaulding. Senator, we share your concern about ensuring 
that the regulatory burden does not fall to heavily on small and 
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medium-sized businesses. We feel a particular obligation to assist 
those businesses, and Director Wulf will be able to speak in some 
detail to all of the things that we have in place, including visits by 
our inspectors, compliance assistance visits to sit down with those 
facilities and give them assistance as well as all kinds of online ac- 
tivities. 

But perhaps most significantly, this is one of the reasons we 
have worked so hard to make Alternative Security Programs a via- 
ble alternative for facilities and to work with the trade associations 
to develop templates, but, again, to sit down with facilities one on 
one to help them work their way through what is a more stream- 
lined process. Director. 

Mr. Wulf. Yes, I think that is all right. Compliance assistance 
is a high priority. We will send our inspectors out to smaller facili- 
ties upon request to consult on security measures, on options. Our 
goal is to provide a maximum degree of flexibility and options for 
facilities to comply. 

With respect to the Site Security Plan questionnaire, we agree. 
We have assessed it. It is too cumbersome. We have already taken 
actions to streamline it. We have removed approximately 100 ques- 
tions that we deemed to be not necessary or redundant in different 
places. We are going to continue to do that, continue to streamline 
that. And as the Under Secretary noted, the use of Alternative Se- 
curity Program templates is another way in which facilities can tai- 
lor plans in a way that may work better for them, for a particular 
industry segment, and for that matter for companies that have 
multiple facilities doing similar things. 

Senator Coburn. Great. Have you all thought about the unin- 
tended consequences of what is happening right now in terms of 
storage of chemicals now, not in a facility but in a railroad car, just 
outside the facility or the fact that — ^because I do not want to have 
to be vulnerable to this regulation — my shipments are now in 
smaller quantities but 10 times as frequent? Have we thought 
about that? 

Ms. Spaulding. We have. Senator. We are aware that there are 
other regulatory regimes that are complementary to ours that we 
believe limit the prospect that risk has merely been shifted with re- 
gard to storage and transportation of hazardous materials, for ex- 
ample. But we are looking at and continue to work at developing 
effective and granular metrics to make sure that we are, in fact, 
enhancing security in America with regard to the risk from high- 
risk chemical facilities. 

And so we have, for example, determined, with regard to Tier 1 
and Tier 2 facilities, that their Site Security Plans have been ap- 
proved, at least in part, based on, about 75 percent of them, up- 
grades in their security. So we know that they are making invest- 
ments that are, in fact, enhancing their security. 

But we are going back and verifying with — looking at bills of lad- 
ing, shipping records, et cetera, what has happened with regard to 
these facilities that have reduced, modified, or eliminated their 
chemical holdings that make them no longer highest risk. 

Senator Coburn. All right. I am out of time. Thank you. 

Chairman Carper. You bet. 

Senator Johnson, thanks for being here. 
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Senator Johnson. Thanks for having me. 

Chairman Carper. Always asking good questions. 

Senator Johnson. I appreciate your welcoming me back. 

Chairman Carper. Thank you. 

OPENING STATEMENT OF SENATOR JOHNSON 

Senator Johnson. Ms. Spaulding, you made a statement about 
companies willfully avoiding compliance. I just want to kind of drill 
down on that. Why would they willfully avoid compliance? 

Ms. Spaulding. Senator, I do not know that we can say with any 
certainty that there are companies out there that are willfully 
avoiding compliance. But what I did say is that if there are compa- 
nies that think they could perhaps wait us out because the pro- 
gram may not be reauthorized, that a long-term reauthorization 
would send a helpful message to them that this program is here 
to stay and they 

Senator Johnson. I understand, but, again, I am just trying to — 
why would anybody willfully not comply? It is a pretty basic ques- 
tion. Why is it? Do you ask yourself that question? 

Ms. Spaulding. Senator, as I indicated, I think that the program 
that Congress has created here, the Chemical Facilities Anti-Ter- 
rorism Standards program, is promoting enhanced investments in 
security. Companies are making greater investments and more im- 
portantly, more effective investments in security than they would 
without this program. And so there may well be companies that 
choose not to make those investments and do not want to, there- 
fore, come under this regulatory regime. 

Senator Johnson. Coming from business, having been Inter- 
national Organization for Standardization (ISO) certified, having to 
pay insurance, having to worry about the liability of something 
going wrong, from my standpoint I would think an awful lot of 
business people would want to comply, want to do it voluntarily if 
the government is facilitating their compliance versus, dictating a 
regulatory regime that might be considered onerous. So that is 
what I am trying to get in terms of what your feedback is from peo- 
ple that are having to comply with this, why would people try and 
avoid it? 

Ms. Spaulding. Senator, I completely agree with you that the 
overwhelming majority of chemical facilities, are willingly com- 
plying with this and understand the value of this across the board 
with regard to the industry and 

Senator Johnson. Have you calculated, getting to Senator 
Coburn’s point about the thick stack of papers that have to be ap- 
parently filled out and the questions have to be answered, have you 
just done a calculation of what it costs to comply for a particular 
company? 

Ms. Spaulding. Senator 

Senator Johnson. And different tiers, I mean, do you have any 
idea of the cost to companies? 

Ms. Spaulding. I would defer to the Director as to whether we 
have tried to calculate the cost. We are certainly aware that this 
can be a burdensome process, which is why we have tried to estab- 
lish as many mechanisms as we can to reduce that burden and con- 
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tinue to look for ways to streamline not only our processes but the 
ability for industry to streamline their compliance. 

Senator Johnson. Let us go to Director Wulf then. Do you have 
any idea what it costs to comply? 

Mr. Wulf. I think we will be in a better position to assess that 
as part of the rulemaking process as we move forward with our Ad- 
vanced Notice of Proposed Rulemaking, a Notice of Proposed Rule- 
making, and doing that cost-benefit analysis. I do not think that 
data existed as much when the program was getting started the 
last time rulemaking occurred. I 

Senator Johnson. In other words, that is something you really 
have not considered yet, you have not really 

Mr. Wulf. Well, I think we are cognizant 

Senator Johnson [continuing]. Put a pencil to that or get feed- 
back from companies? Have you ever had a company say, “This has 
already cost me $100,000” or 

Mr. Wulf. Yes. We hear those things from companies, and our 
inspectors work with those companies to discuss options, in many 
cases much lower cost options than ones they had been considering, 
but options that will work to meet our non-prescriptive Risk-Based 
Performance Standards. So that is one of the great things about 
the CFATS program and why I think it is really uniquely well tai- 
lored to this industry, which is not a cookie-cutter industry. It is 
not even one industry. It is just a probably, I am going to say, al- 
most in the hundreds of different types of facilities that are part 
of the CFATS universe. What works for one company to meet a 
Risk-Based Performance Standard may not be appropriate for an- 
other company. So CFATS is about providing options and flexi- 
bility. It is non-prescriptive. We absolutely will work with compa- 
nies to discuss a variety of options. 

Senator Johnson. I am new to this issue. Are there penalties for 
noncompliance? 

Mr. Wulf. Yes, there can be. There can be fines. 

Senator Johnson. And are those already being implemented? 

Mr. Wulf. We have not fined a company for 

Senator Johnson. But you have the power to do that? 

Mr. Wulf. We do. 

Senator Johnson. Have you tried to look at any private sector 
compliance or other, for example, the insurance market or ISO cer- 
tification, have you looked at any other types of private sector cer- 
tification programs that you can tie into to make this far more cost- 
effective? I mean, ISO certification, when I am listening to the 
delays in getting people compliant, ISO certification is a very big 
deal for a manufacturer, but it does not take 3 or 4 years to get 
certification. It takes, if really done well, you can do it in a year. 
Have you looked at tying into those systems that are already in 
place? 

Mr. Wulf. We have had discussions with industry associations, 
which manage some, I think, very effective stewardship programs, 
things like the Responsible Care program, the ChemStewards pro- 
gram, the relatively new Responsible Ag program, which promote 
security at different types of chemical facilities. So we will continue 
to discuss the ways in which we can leverage those programs. 

Senator Johnson. How familiar are you with ISO certification? 
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Mr. WULF. I am not very familiar with it. 

Senator Johnson. That would be something I would highly rec- 
ommend you get up to speed on, and I would talk to the certifi- 
cation companies that do ISO certification, because this is exactly 
what manufacturers go through. They do a risk assessment. They 
have to comply to make sure that, if something catastrophic were 
to happen, they know how to handle that, how to prevent those ca- 
tastrophes from occurring. I mean, I would think that would be a 
natural coordination between ISO certification and then also the 
insurance market. If you want to drive compliance in business, 
probably the best way to do it is, well, if you comply, your insur- 
ance rate is going to be lower. It is a natural way to facilitate com- 
pliance as opposed to having — holding penalties over somebody’s 
head. Does that make sense? 

Mr. WuLF. Yes. 

Senator Johnson. OK. From my standpoint, I would love to see, 
again, the government contact ISO certification companies. I think 
you would be able to move this process forward at a much more 
rapid pace. 

Mr. WULF. We can certainly do that. 

Senator Johnson. And I doubt there are any of the large chem- 
ical manufacturers that are not ISO certified. You can just plug 
right into that process. 

Ms. Spaulding. Senator, thank you. As Director Wulf said, we 
certainly have been in discussions with industry and are looking at 
all of the ways in which we might be able to hasten the elimination 
of this backlog consistent with our national security imperative, 
and that is certainly one of the ones that we are looking at. 

I did want to note that, with regard to your earlier question 
about the burden of compliance, we do have — each of our processes, 
the Top-Screen, the Security Vulnerability Assessment, and the 
Site Security Plan, are considered information collection requests, 
and pursuant to 0MB process, we did have to provide them with 
estimates on the burden of this regulatory compliance, and I be- 
lieve that is information we can provide you. 

Senator Johnson. OK. I would appreciate that. Thanks. 

Chairman Carper. Thanks, Senator Johnson. Those were good 
points. Thank you. Senator Levin. 

OPENING STATEMENT OF SENATOR LEVIN 

Senator Levin. Thank you very much, Mr. Chairman. It is a very 
important hearing. We thank you and Dr. Coburn for having this 
hearing. It is a big industry in my State, the third largest, as a 
matter of fact, manufacturing industry in my State. I think there 
are 28,000 employees. And so to make sure that this program is 
fairly and effectively working is really important to us. 

I have a couple quick questions. One has to do with the fines 
that Senator Johnson asked about. As I understand, there are no 
fines for not filing. Is that correct? If you do not file, if an industry 
does not file, there is no fine. 

Mr. Wulf. I think there is a school of thought to suggest that 
until a facility becomes regulated, goes through the process of filing 
its Top-Screen, being determined to be high-risk and having a Site 
Security Plan approved, the enforcement mechanisms may not 
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apply. I think our view is that we can issue a notice requesting or 
essentially ordering a facility to comply, to file, and then move for- 
ward in the enforcement process. 

Senator Levin. Is that the way you are operating. 

Mr. WULF. Yes. 

Senator Levin. Are you fining people who do not file when you 
find out about their existence? 

Mr. WuLF. We have issued I think 66 administrative orders 

Senator Levin. No, that is not my question. Do you fine people 
for not filing? I know you have issued orders. After you find out 
about them 

Mr. WuLF. We believe we could fine them, yes. 

Senator Levin. But you have not fined any 

Ms. Spaulding. We have not. 

Mr. WULF. Everyone has come 

Senator Levin. But you think you have the power. 

Mr. WuLF. We do. 

Senator Levin. Do you have any idea as to what number of peo- 
ple have not filed who should file? 

Mr. WULF. Well, I think that is a difficult 

Senator Levin. You have no idea. 

Mr. WULF [continuing]. Number to know. I think we know that 
we have engaged in extensive outreach, 11,000 or more separate 
outreach engagements, and that has generated upwards of 48,000 
Top-Screen filings. We believe we have a good handle on the known 
universe of high-risk chemical facilities, and we are working with 
our partner agencies to cross-walk data sets and to ensure that we 
are doing all that we can to identify potentially noncompliant facili- 
ties and bring them into the program. We are also working with 
State agencies, with State homeland security advisers to reach 
down 

Senator Levin. OK. I was asking about penalties for non-filing. 
At any rate, I want to ask also about your budget. Your budget has 
been cut, I see. Is there any effect on this program by the cuts in 
funding for the program? Has that had an effect? And does that 
help create the backlog? 

Ms. Spaulding. Senator, we do not believe so. We have had to 
make some difficult choices with regard to our budget 

Senator Levin. But that is not one of the causes 

Ms. Spaulding [continuing]. But the approval process has picked 
up speed over time. 

Senator Levin. All right. So there is no relationship between 
budget and the backlog or the speed of administration of the pro- 
gram? 

Ms. Spaulding. Senator, at this point we believe we have the re- 
sources we need to sustain this pace and reduce this backlog. 

Senator Levin. All right. If you had more resources, could you 
speed up the pace? 

Ms. Spaulding. Again, at this point we believe that we — we have 
streamlined the process 

Senator Levin. I understand. My question is: Could you pick up 
the pace if you had more resources? It is pretty straightforward. 

Ms. Spaulding. Yes, frankly. Senator 

Senator Levin. I am not asking if you are asking for them 
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Ms. Spaulding [continuing]. If there were more 

Senator Levin. I am just asking you a straightforward question. 
If you had more resources, could you pick up the pace? It is a very 
direct question. 

Ms. Spaulding. If there were more people reviewing the Site Se- 
curity Plans and if there were potentially more inspectors, al- 
though I am not sure the approval — that there is any backlog in 
inspections, but certainly with regard to reviewal of Site Security 
Plans and working with industry on the Alternative Security Plans, 
it is entirely possible. Senator. 

Senator Levin. There is a question of background checks for em- 
ployees and unescorted visitors that I want to ask you about that 
provide identifying information to the DHS for use in screening em- 
ployees against the terrorist screening database. The DHS is still 
in the process of finalizing how exactly facilities ensure that indi- 
viduals with known terrorist affiliations do not gain access to high- 
risk facilities. A major chemical company, Dow Chemical in my 
State, told me that they are concerned that DHS does not tell them 
if someone in their facility is on the terrorist screening database. 
And labor groups are concerned that there is no transparency in 
the process, and for workers who might be inaccurately classified, 
that there is no appeal process. 

Well, let me put it. Director Wulf, to you: When will the process 
for which personnel surety or screening is going to be finalized by 
the DHS? 

Mr. Wulf. We hope it will be finalized soon. We 

Senator Levin. Can you give me just an approximation? 

Mr. Wulf. I think you would have to ask 0MB, because the doc- 
umentation is up there for final approval right now. 

Senator Levin. Well, what are you recommending? 

Mr. Wulf. We are recommending a — well, we have proposed a 
program which would provide a number of different options for fa- 
cilities to ensure vetting of persons who are seeking unescorted ac- 
cess to high-risk chemical facilities and the chemical holdings 
thereon. So the ability to directly vet those individuals by directly 
submitting information to the Department for vetting, the oppor- 
tunity to leverage other vetting that has taken place, such as 
through the Transportation Workers Identification (TWIC) pro- 
gram, or the Hazardous Materials Endorsement program, as well 
as the opportunity to conduct vetting electronically and the oppor- 
tunity to propose an additional option or options that we may not 
have considered. 

So we have tried to design a program that affords maximum 
flexibility. That is what we propose, and that is what is sitting 
at 

Senator Levin. And that is what you proposed to 0MB? 

Mr. Wulf. That is right. 

Senator Levin. And if they approve that program, how long after 
they approve it would it be in place? 

Mr. Wulf. I think it would be within months. But we would pro- 
ceed in a measured fashion. We would work first with a handful 
of facilities to ensure that we were getting everything right, that 
facilities were able to work well with the online system that we 
have developed to facilitate this vetting. But we do believe that this 
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is an important hole in the program that needs to be filled soon, 
ensuring that folks who are seeking unescorted access to our high- 
er-risk chemical infrastructure are, in fact, vetted against the ter- 
rorist screening database. 

Senator Levin. Has 0MB told you when they are going to give 
you an answer? 

Mr. WULF. They have not. 

Senator Levin. Thank you. 

Thank you, Mr. Chairman. 

Senator Coburn. Could I? You tell me if I am wrong on this. All 
of the DHS proposals for personnel surety require submitting infor- 
mation to CFATS, even if they have already been vetted by other 
DHS agencies? 

Ms. Spaulding. Not exactly. Senator. There is an option there 
for facilities to use — to better leverage existing credentials from 
DHS that 

Senator Coburn. When did that go out to industry? Because that 
is not what I am hearing from industry. 

Ms. Spaulding. We have spent months talking with industry to 
make sure that we understand their concerns and to talk with 
them about the ways in which we are thinking about this program 
and have shared — again, it is difficult to get out to all of the 4,000- 
plus facilities that are regulated, but we have in our notice or re- 
quest that is with 0MB included a proposal that would allow an 
electronically verified TWIC card to be used for meeting the per- 
sonnel surety standard. And that does not require that they submit 
any information to the Department beyond what is already done in 
the TWIC program. 

Senator Coburn. What about a Hazardous Materials Endorse- 
ment (HME)? 

Mr. WuLF. I do not believe there is currently a way to electroni- 
cally verify a hazardous material 

Senator Coburn. But if somebody has that card, why do they 
have to get verified again by DHS? That is the question I am ask- 
ing. It is make-work. If they have already cleared one agency in 
DHS, why do they have to clear another one? If they are good 
enough for part of it, why can’t they be good enough for this? 

Ms. Spaulding. Senator, our concern is to make sure that the 
credentials that are being used to access the most sensitive parts 
of chemical facilities, where the chemicals of interest, highest-risk 
chemicals are located, that those credentials are still valid and are 
still held by the person who should be 

Senator Coburn. I understand that, but if they have been 
cleared by one agency in the Department of Homeland Security and 
termed a “chemical handler,” why isn’t that good enough? Why 
can’t they just submit this employee has this card, you have al- 
ready approved them for handling the highest-risk chemicals, now 
you are going to make them go and get another certification from 
the same department of government to say, oh, yes, by the way, 
you are OK? Why can’t a business just say these people right here 
already have a TWIC card, already have a Hazardous Materials 
Endorsement, why aren’t they cleared automatically? 
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Mr. WULF. We would just be asking those facilities that are look- 
ing to leverage that existing vetting to provide us information like 
that in a number 

Senator Coburn. Well, why should they have to — why can’t they 
just keep it on file there and avow that we have these people cov- 
ered? Why would we make them do it again? I mean, their TWIG 
card is not forever. 

Ms. Spaulding. Senator, under the Maritime Transportation 
Safety Act, which the Coast Guard administers at maritime chem- 
ical facilities, that regime always envisioned the use of an elec- 
tronic reader as an essential and important 

Senator Coburn. You are missing my point. I am not talking 
about electronic. I am talking about if a company says these people 
are certified and we can prove it in our files, when you come in to 
inspect that, rather than make them go through the process of 
sending a whole lot more information to you, which you really do 
not need, and their assumption is there is a penalty if I am lying 
about somebody’s access, there is nothing to be gained by having 
them have another surety requirement when they have already 
passed two surety requirements from the same department. That 
is my point. 

Ms. Spaulding. Senator, those regimes are — those credentials 
are for different purposes, and what the Personnel Surety Program 
is about is access to the most highest-risk chemicals within a facil- 
ity, unescorted access to those chemicals. And the HME card is for 
a different regulatory purpose. 

Senator Coburn. But you would agree, if somebody has an HME 
card, they have access to them anyway. So what is the difference? 
I mean, you have already done a security check on them. 

I am finished. Sorry. 

Ms. Spaulding. Senator, I take your point, and I understand the 
point you are making. Again, our interest is in making sure that, 
with regard to people who have unescorted access to these chemi- 
cals, that this card, the credential that they have, is still valid and 
they are the appropriate card holder. We will continue to work 
with industry and with the Committee to find ways to accomplish 
that security objective that is least burdensome to industry that we 
can possibly 

Senator Coburn. But what I hear you saying, they are still going 
to have to submit to the CFATS that we have an HME card or we 
have a TWIC card, and then they are going to have to apply. 

Ms. Spaulding. Senator, there is a fourth option under our re- 
quest with 0MB, and that is for chemical facilities to present us 
with their alternative to meet the security standard, and that re- 
flects our ongoing commitment. We do not necessarily have all the 
answers. There may be alternatives there that we have not yet 
thought of that industry will come forward with, and we are open 
to that possibility. 

Senator Coburn. If a truck driver with a TWIC card is carrying 
a load of isopropyl percarbonate, which is a catalyst which can ex- 
plode if you lose the refrigeration on it, they have access to a bomb. 
And if we are going to recheck that truck driver when they are un- 
loading into a special area in a special plant, again, against a code 



20 


that is redundant and not efficient and cost prohibitive. That is the 
kind of point I am trying to make. 

I will make one other point. I think it was during the Clinton Ad- 
ministration under OSHA that they decided that they were going 
to take a period of time where they were going to not be a penal- 
izing organization; they were going to be a fixing organization. And 
the response of the industry was miraculous. OSHA came in, said, 
“You have these problems. We want you to fix these problems. We 
are not going to penalize you. Fix them. We will come back in 6 
months and look at it.” And that approach did more for employee 
safety than all of the other OSHA regulations we have ever done. 
And I hear from Mr. Wulf that that is the kind of approach you 
are tp^ing to take. And what I would say is that is the approach 
that is going to work best with industry: a cooperative, compliant 
partnership that solves these problems. 

Chairman Carper. This past Sunday was Mother’s Day, and I 
am sitting here not channeling my mother but my father, and my 
father was always saying to my sister and me, when we would do 
some bone-headed stunt, he would say, “Just use some common 
sense.” This may be one of those situations where a little common 
sense would go a long way. And I think Dr. Coburn raises some 
important points. I think you know that. Let us just figure out how 
we can address that, those concerns. 

The other thing I would say is you all are interested in if not a 
permanent reauthorization, at least a multiyear reauthorization. I 
think I heard 5 years from you, Ms. Spaulding, and the House, our 
counterparts in the House, reported out a reauthorization of, I 
think, 3 years. I think we started off, maybe when this program 
was created, with a 3-year authorization, I believe. And since then 
we have been pretty much without authorization, as I understand. 
And somewhere between no authorization and permanent, there is 
a number there that probably works. And to the extent that you 
can continue to take seriously the concerns Dr. Coburn is raising 
and others are raising, to the extent that you can take seriously 
those concerns and address them in a way using some common 
sense, we are going to get closer — we are not going to go to perma- 
nent, but we will get closer on that end of the scale than to zero. 
So that would be my knowledge that I would share with you on 
this. 

Mr. Caldwell, I do not think you have been talking nearly 
enough today, and we are going to give you an opportunity to rec- 
tify that. And put yourself in our shoes. I am reminded a little bit, 
Tom and Ron, I am reminded a little bit of what DHS did in mov- 
ing from the high-risk list, unable to even be auditable much less 
get audited, to move not with lightning speed but to move pretty 
fast from a point of being auditable to getting — passing a clean 
audit. It was pretty impressive. We urged our DOD friends yester- 
day to take a chapter out of that book. 

I think that this program in terms of going where it needs to go, 
you are sort of at the same point where — it is not the right anal- 
ogy, but I will say you are auditable, close to auditable. But what 
we need to do is just not to say, OK, well, things are going fine 
and we will rest on our laurels. I mean, this is time to put our foot 
on the pedal to the metal and just push it on through. And to the 
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extent that we can do that — and we would play a role in that obvi- 
ously — we will all be better off. 

All right, Mr. Caldwell. We are not going to talk about it right 
now, about all the good things that are being done. There are a 
number of those, and we applaud that. But I want you to help us 
focus on that which still needs to be done by the Department, by 
Mr. Wulf and the folks who work in this program under the direc- 
tion of Ms. Spaulding. Focus on the stuff that still needs to be ad- 
dressed and that you guys have pointed out, and just let us talk 
about that. You have heard from Dr. Coburn and others some of 
our concerns on what needs to be done. Just speak to those, please. 

What I want to get here, I want to get some consensus, sort of 
a to-do list coming out of here, what we think you need to be doing 
and what you all think we need to be doing, and let us just move 
forward. 

Go ahead, please. 

Mr. Caldwell. Well, in terms of your analogy to the high-risk 
list, there are a couple of areas where we pointed out serious prob- 
lems with the programs. We had help from the Department doing 
that, when their internal memo was leaked a couple years ago, that 
these were indeed serious problems. 

We have found — and we think that our involvement helped 
this — that the Department has put together some very specific ac- 
tion plans. For example, they had a 94-item action plan to address 
the serious management problems they had. Now they have an an- 
nual operations plan to actually operationalize that plan so that 
they are tracking some of these things that they are doing. At least 
for some of those management problems, we are beyond the most 
serious problems to focus on actually running the program, so I 
think that is positive. 

In terms of running the program, the biggest issue that we have 
at this point as an open issue is the vulnerability assessments. We 
have open recommendations on that. And going back to the ques- 
tions you had asked about the risk management that Senator 
Coburn had talked about. In terms of the consequence, even their 
own rules said that certain types of consequences are going to be 
included, and they did not include those. For example, economic 
consequences, according to their own rule, were going to be looked 
at, but they did not look at them. 

And in terms of vulnerability, they said they were going to look 
at vulnerability, but late in the process when they actually inspect 
the facility plans. To us, vulnerability is one of the things you con- 
sider up front. I do think it makes perfect sense to look at con- 
sequences first. But the reason that we got for them not including 
vulnerability is it was self-reported information, at the beginning 
of the process. 

Well, everything about the program is self-reported. So that just 
did not make sense to us. That is the biggest issue. DHS did have 
an internal review by the Institute for Homeland Security Analysis. 

The issue that we have not even looked at is the personnel sur- 
ety one, which I have already talked about. 

Chairman Carper. On the point he just made, very briefly, 15 
seconds, just respond please, Ms. Spaulding. 



22 


Ms. Spaulding. So we did get recommendations from the exter- 
nal peer review on ways in which we might be able to better incor- 
porate vulnerability in our risk-tiering methodology, and we are 
working through those recommendations now. 

Chairman Carper. Good. Thank you. 

Mr. Caldwell, please proceed. 

Mr. Caldwell. We are talking about them tweaking their meth- 
odology to have something consistent with the National Infrastruc- 
ture Protection Plan (NIPP) and some of the standard risk manage- 
ment methodologies the Department uses. We think those are good 
criteria. 

We do not want them throwing new facilities on the list or off 
the list. At this point it would be reasonable as they go forward to 
amend as they go. Or else you are never going to get to a stable 
list of facilities that have requirements to be met. 

From our standpoint, obviously, the service we at GAO provide 
is going in and actually verifying the information. So we are about 
to start on our next phase of that audit work. We have, as I said, 
mandates from the appropriators as well as from the House side 
on the authorizers. We can work with this Committee if you want 
to be part of that audit. So that is it there. 

In terms of the bigger issue before you, which is authorization, 
I think that there are certain advantages of that. It provides some 
stability in terms of the CFATS workforce. Industry wants it as 
well. They want the stability, too. They want to know that CFATS 
is going to drop off. As Senator Johnson said will there actually be 
incentives for industry, not joining to joining or not reporting or re- 
porting. 

The House bill also codifies some of the current practices based 
on regulation. But there is less authority if the regulations are not 
in the law. The House bill which we have been working with them 
on does emphasize certain corrective actions that need to be taken. 
So, I think we are on a path forward. There is impatience, and that 
is understandable. But, DHS appears to have a commitment to 
change, we are seeing that. 

Chairman Carper. I feel like Dr. Coburn wants to jump in here. 

Senator Coburn. Well, I would just make two points. 

One, if we were starting over, what I think this Committee 
would recommend is much what the TSA did with the Pipeline Se- 
curity Branch. It was a total collaborative process from the begin- 
ning where you had industry input working with committed gov- 
ernment individuals to create a pipeline program against terrorism. 
It created a small amount of paperwork with massive compliance 
on part of the industry because they were part of it. 

The second example I would give is the President’s Executive 
Order on cybersecurity. It was a total collaborative process where 
the Administration listened to the players and we are getting a 
good result. And we did not do that in this. 

The final point I would make is if you have an explosives permit 
from the Bureau of Alcohol, Tobacco and Firearms (ATF), under 
your proposed guidelines, you still have to get another clearance 
from Homeland Security. That makes no sense whatsoever. And so 
you have to fix that. 
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So I do not know what you have at 0MB, but I know what is 
rumored to be there, and what is rumored to be there is not going 
to be acceptable. So you have to figure out a way to utilize the re- 
sources of the rest of the government when we give clearances to 
somebody, especially an explosive permit. To say they have to go 
to another agency to get another permit again is absolutely — well, 
I will not use the word that I am thinking. 

Chairman Carper. Now we are just going to wonder what word 
he was thinking. Let me reclaim my time 

Mr. Caldwell. I think it was an acronym, sir. 

Chairman Carper. It was an acronym? OK, probably. 

I want to turn to a concern relating to the ease of compliance for 
a large company, think DuPont, think Dow, as opposed to a small 
company that deals with some of these dangerous chemicals and 
has maybe a half dozen employees, and they are just trying to fig- 
ure out how to keep afloat and meet payroll and sell their products 
and so forth. 

There are some concerns I have heard that some of our larger 
chemical companies may actually be advantaged by this program 
because it is easier for them to comply, and their small competi- 
tors, very small competitors, find it very difficult to comply. And I 
just want you to respond to that concern, Ms. Spaulding, if you 
would, please, and sort of the point here is similar to what Dr. 
Coburn raised earlier, ease of compliance, particularly for smaller 
companies, keeping an eye on risk. 

Ms. Spaulding. Senator, it is a legitimate concern, and it is one 
that we share, and which is why we have worked hard to have in 
place as many mechanisms as we can to assist small and medium- 
sized businesses to comply with this important regulatory program. 
And that includes, onsite compliance assistance visits by our in- 
spectors who are all across the country, who will come in and sit 
down with that facility, and provide whatever assistance they need 
in meeting their requirements. 

We have, the ability to call someone, a help desk. We have online 
resources. And, again, one of the things that we recognized some- 
time ago was perhaps most helpful was this option for an alter- 
native security program, which can be a much more streamlined 
way of meeting the regulatory requirements with regard to submit- 
ting a security plan for your facility. And we have worked very 
hard with — industry has come to the table in full collaboration on 
this to help their industry partners by developing templates that 
will significantly ease the burden for companies to comply. 

Director Wulf, if you want to add anything to that? 

Mr. Wulf. I think that is all covered very well. With respect to 
compliance assistance, as we work with these smaller companies to 
discuss options for meeting the Risk-Based Performance Standards 
and getting those Site Security Plans or Alternative Security Pro- 
grams into shape, such that we are at a point where we can au- 
thorize the plan and go ahead and inspect it, I think it is important 
to recognize that although we have only gotten to — we have in- 
spected, done formal inspections of a little more than 1,000 facili- 
ties, our inspectors have been out at other facilities that have not 
yet gotten to the point of inspections. So we are working particu- 
larly with smaller companies on a regular basis, and security is 
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being enhanced at those facilities, even prior to the formal inspec- 
tion and approval. 

Chairman Carper. All right. Thank you. We are going to start 
a vote, a series of several votes, in just a couple of minutes, and 
I think Dr. Coburn, when we start that, will go over and vote early 
and come back so I can vote on the first and second votes, and then 
we will switch places again, and when I come back, I will ask ques- 
tions. 

I want us to drill down on the backlog. It used to be 7 to 9 years. 
It is now maybe half that. That is progress, but can we do better? 
You bet we can. And I want to just talk about specifically what you 
all need to do better, what we need to do to enable you to do better, 
and maybe what industry needs to do. 

Tom, would you like to ask anything else before you head out? 

Senator Coburn. No. I just would remind Under Secretary 
Spaulding we really want that analysis of what the peer review 
said versus what your response was. 

Ms. Spaulding. Absolutely, Senator. We will get that to you. We 
very much valued the peer review’s recommendations, and as we 
have indicated, we have an implementation plan, and we would be 
happy to get that information over to you. Thank you. Senator. 

Chairman Carper. All right. Thank you. Senator Johnson. 

Senator Johnson. I will just reinforce the point that you have 
literally thousands of private sector inspectors out there that can 
help you out. Whether it is people rating for insurance, whether it 
is ISO certification, those surveillance auditors, use them. No sense 
creating an extra burden for businesses. You have one inspection 
here, you have another inspection here. Rather than actually pro- 
ducing products, rather than concentrating in innovation, we are 
just worrying about audits and inspections. It gets pretty burden- 
some. 

So utilize what is already out there. Try and kill two or three or 
four birds with one stone. I would really encourage that. I think 
you would be far further ahead if you tied into ISO certification 
problems, if you tied into the insurance rating systems. It would 
work. 

Ms. Spaulding. Thank you. Senator. 

Chairman Carper. When our witnesses were before us yesterday 
from the Department of Defense, the Comptroller and others, we 
were acknowledging that they are making some progress toward 
moving toward being auditable. At least within the Marine Corps 
they are making some progress, the Navy, Department of Navy, the 
others beginning to but not nearly enough. And I said to our wit- 
nesses — Bob Hale, the Comptroller who is leaving, a good man. But 
I said to him and to them, “We acknowledge that it is not all on 
you. Part of this is on us.” And he said, “Well, we tried to make 
progress toward becoming auditable and to get a clean audit. But,” 
he said, “it has been challenging in the fiscal environment we have 
operated in recent years — shutdowns, fiscal cliffs, continuing reso- 
lutions, lack of certainty, lack of predictability.” And he is abso- 
lutely right. 

Part of this — what is it? — “We have looked at the enemy, and it 
is us.” There is some of that going on here with respect to their 
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becoming auditable at DOD and our doing an even better job on 
this particular program. 

Before we break and bring on the second panel, let me just ask 
this: What can we do — and I think part of it would be a reauthor- 
ization, but just what can we do with some specificity, feel free to 
mention that, but then drill down a little bit beyond the 3, 5, or 
whatever period of time would be most helpful. And, Mr. Caldwell, 
I am going to ask you to go last on this, but, Suzanne, if you would 
just start off, and then David and then Steve, but, please, our re- 
sponsibilities. 

Ms. Spaulding. Mr. Chairman, thank you very much. Thank you 
for the question, and thank you for your interest and hard work 
and efforts to make sure that this program is on track and is where 
it needs to be. I indicated earlier how much we valued the peer re- 
view, outside input and recommendations. We very much value 
GAO’s second set of eyes, third, fourth set of eyes on our program, 
and we very much value the oversight of this Committee in helping 
us make sure that we are meeting the national security imperative 
in a way that makes sense for industry and keeps America safe. 
And so that continued oversight 

Chairman Carper. I am going to interrupt you. 

Ms. Spaulding [continuing]. Will be helpful. 

Chairman Carper. Give me some specifics. I want some specifics. 
This is your chance to ask us, this is your — to say, “Here is your 
to-do list.” Give us your order. Or we will take the order, so, please, 
take advantage of it right now. 

Ms. Spaulding. Thank you. I would, say again that the long- 
term authorization, permanent authorization for this program is 
probably the single most important thing that Congress could do to 
help advance this program. 

Chairman Carper. All right. 

Ms. Spaulding. For all of the reasons that we have talked about, 
and you mentioned in yesterday’s hearing the references to 

Chairman Carper. I have that. Let us go — OK. 

Ms. Spaulding [continuing]. The economic challenges. 

Chairman Carper. You can move on from that. I have that. 
Thank you. 

Ms. Spaulding. Right. And with regard to further legislative pro- 
posals, we are looking at that, at ways in which the current statu- 
tory regime, might be strengthened to give us authority. We are 
looking at, for example, is the compliance regime and our ability 
to bring enforcement actions, does that need to be strengthened? 
Does that need to be streamlined? And that is something we are 
looking at, and we will come back to the Committee, when we have 
finished looking at that. 

Again, I think Congress, in creating this Risk-Based Performance 
Standard Program, which does not require facilities to build a 15- 
foot fence but gives them the leeway to develop the measures based 
on an outcome, is the right approach. And so I would encourage 
that authorization to continue that approach, which is, again, an 
outcome-based approach. 

We are looking at, in the context of rulemaking, whether we 
want to open this up and make some changes to our rule. But, 
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again, I think authorizing the program more or less as it currently 
stands is really, what we are looking for from Congress. 

Chairman Carper. All right. 

Ms. Spaulding. Director Wulf may have some 

Chairman Carper. Before you say anything, David, when Jane 
Holl Lute was the Deputy, she used to come before us and testify. 
Deputy Secretary at DHS, we would ask her, “How did DHS get 
off the high-risk list at GAO for any number of sins?” And she said 
one of the things that she did, she would go meet with Gene 
Dodaro, the Comptroller General, literally in his office, and say, 
“We want to get off your high-risk list. What do we need to do to 
do that?” And they were just like chapter and verse: This is what 
you need to do, this is what you need to do. And I think her leader- 
ship and Rafael Borras, his leadership in the Department, were 
enormously helpful in that, I am sure the Secretary’s admonitions 
as well. 

Mr. Wulf, far be it from me to tell you what to do, but if the Dep- 
uty Secretary of the Department can go call on the Comptroller 
General and his staff again and again and again to, clear out the 
underbrush and get off the high-risk list in a variety of ways, you 
may want to consider some visits over here to the Hill. And my 
wing man here. Dr. Coburn, he has some real reservations — you 
have heard them today — real reservations on what — not to take 
away from the work that has been done, but actual things that 
need to be done. And to the extent that you can almost one on one 
with some of your team work with him and his team, that would 
be enormously helpful to you and I think to us, so I would urge you 
to do that. 

Mr. WULE. Yes, we absolutely will do that. 

Chairman Carper. All right. Thank you. 

Mr. Caldwell, any closing statements here to help us along. 

Mr. Caldwell. Yes, a couple of things. Some are asking the real- 
ly big question about CFATS, like: Is this the right approach, or 
should we start over again? If we start over again, it is going to 
be years before we have anything in place. At GAO, the most im- 
portant criteria is the laws that Congress passed, and CFATS was 
passed, and there has been appropriations for it, so we see that as 
a sign of congressional support. There are advantages of author- 
izing the program in terms of the stability, both to the people run- 
ning the program as well as to industry. 

In terms of authorizing legislation, the House has already taken 
that up, and there are ways to nudge the Department to do things 
where there is congressional interest in particular improvements. 
One thing that comes to mind is discussion about the small busi- 
ness community and how to help them. The House bill does have 
a section to help small business. So that is an example where Con- 
gress can make sure things happen by putting them in legislation. 

On the personnel surety side, I am not really sure what is going 
to happen. I do not know how to get that rule out of 0MB. I am 
not sure the Department knows or Congress knows at this point 
how to move 0MB. 

Chairman Carper. All right. At least we can have a conversation 
with 0MB, and we are going to have that this week, and this hear- 
ing has spurred us to do that. Sometimes that can be helpful. 
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Mr. Caldwell. So that would be good. 

Chairman Carper. All right. I have these guiding principles that 
I try to follow. They are kind of like my moral compass. And we 
have actually touched on a number of them here today. 

One, if it is not perfect, make it better. 

Another one is just use some common sense. I think we see some 
opportunities to do more of that here. 

I have a friend who, if you say to him, “How are you doing?” he 
says, “Compared to what?” And if you compare this program to 
where it was a half dozen years ago, you have come a long way. 
But we are not in the end zone; we are not in the red zone. And 
we need to get there. 

I used the analogy yesterday, I will use it again today: In naval 
aviation, when — I was an old Navy P-3 aircraft mission com- 
mander for a number of years. In our airplane, the P-3 aircraft — 
the plane that has been used over the Indian Ocean to do a lot of 
these searches. But in aircraft, you are coming down the runway 
to begin your takeoff roll, and you reach a spot in your takeoff roll 
called “the refusal speed.” And refusal speed is the point where the 
pilot in command either pulls back on the throttle and you stay on 
the ground, or you push ahead and fly. I think we are really sort 
of — I thought we were — yesterday I said, “I think we are at refusal 
speed at DOD in the work they are moving toward, getting a clean 
audit.” I think this program is at refusal speed, too. And just like 
DHS decided to push ahead and to fly to the goal of getting a clean 
audit, I think that is pretty much where we are. And just like DOD 
needs to go to school on DHS and how they got a clean audit, there 
are, I think, some opportunities here for us to learn as well. And 
a big part of it was Jane Holl Lute and probably Rafael Borras 
coming over personally and meeting with GAO folks and saying, 
“OK, what do we need to do? What are we doing? And what more 
can we do? And what help do we need?” So keep Qiat in mind. 

With that, we are going to call our second panel of witnesses for- 
ward, and, Ms. Spaulding, I think we get to meet with you on a 
different subject later today. 

Ms. Spaulding. I am looking forward to it. Senator. Thank you. 

Chairman Carper. We look forward to it as well. Thank you so 
much. 

Ms. Spaulding. Thank you very much. 

Chairman Carper. Thanks, Mr. Wulf. 

Mr. WULE. Thank you. 

Chairman Carper. Thank you, Mr. Caldwell. And, Mr. Caldwell, 
everybody at GAO who worked day and night very hard and who 
provide great service and assistance to us in our jobs, we want to 
again thank you. And we need your help. Just like you have been 
helpful to our friends over in the House as they fashioned their bill, 
we would like to have some of the same. 

Mr. Caldwell. And such meetings have already started, so 
thank you. 

Chairman Carper. Thanks so much. 

[Pause.] 

All right. Good morning. I am not going to introduce or provide 
a formal introduction for our witnesses. We are happy you are 
here. It is nice to see you all, and we welcome your testimony. 
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We are going to go ahead and start, and Dr. Coburn may well 
come back and spell me so I can run and vote the first and second 
votes, but the idea is to keep moving and to give you full oppor- 
tunity to hear — it will give us a full opportunity to hear your testi- 
monies and then for us to be able to have a good conversation. So 
welcome. Dr. Shea, why don’t you go first? 

TESTIMONY OF DANA A. SHEA,i PH.D., SPECIALIST IN SCIENCE 

AND TECHNOLOGY POLICY, RESOURCES, SCIENCE, AND IN- 
DUSTRY DIVISION, CONGRESSIONAL RESEARCH SERVICE, 

LIBRARY OF CONGRESS 

Mr. Shea. Thank you for the opportunity to testify before the 
Committee today about Federal efforts to secure chemical facilities 
within the United States from terrorist attack. In addition to my 
remarks today, the Congressional Research Service (CRS) has sev- 
eral reports on this topic, and in accordance with our enabling stat- 
utes, CRS takes no position on any related legislation. 

My testimony has three parts. First, I will reference the CFATS 
program’s progress and challenges; second, I will identify several 
policy issues regarding authorization 

Chairman Carper. Let me just say, were you here when I made 
my earlier admonition to our first panel about acronyms? 

Mr. Shea. I was. 

Chairman Carper. I thought didn’t they do a great job? I would 
just ask that you follow their example. 

Mr. Shea. Third, I will briefly analyze H.R. 4007, the Chemical 
Facility Anti-Terrorism Standards Program Authorization and Ac- 
countability Act of 2014. 

The 109th Congress authorized DHS to regulate chemical facili- 
ties for security purposes. Subsequent Congresses have extended 
this authority, which now expires on October 4, 2014. Advocacy 
groups, stakeholders, and policymakers have called for its reau- 
thorization, though they disagree about the preferred approach. 

Since 2007, the CFATS program has received more than 46,000 
Top-Screen submissions from over 36,000 chemical facilities. DHS 
currently regulates approximately 4,100 facilities as high risk. 

DHS has had challenges in implementing the CFATS regula- 
tions. These include a persistent backlog of high-risk facilities not 
assigned a final risk tier, an ongoing effort to develop and imple- 
ment a personnel surety Risk-Based Performance Standard, and a 
failure to meet DHS expectations for inspecting regulated facilities 
and approving Site Security Plans. 

That said, the pace of DHS authorization, inspection, and ap- 
proval of Site Security Plans at regulated facilities has increased 
compared to the early days of the CFATS program. 

Policymakers have considered chemical facility security in the 
113th Congress. Some of the issues debated include: how to assess 
facility risk, whether to employ third parties as inspectors, and 
whether DHS should be allowed to mandate facilities use certain 
approaches or chemical process practices, also known as “inher- 
ently safer technologies.” 


^The prepared statement of Mr. Shea appears in the Appendix on page 70. 
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A key underpinning of the CFATS program is its assessment of 
facility security risk. The DHS is currently determining how to best 
address recommendations for improving its risk assessment proc- 
ess. 

Congressional policymakers may be interested in how changes in 
how DHS determines risk affect the regulated community and 
what plans DHS has to minimize financial impacts. The regulated 
community’s investment in security measures will increase as pro- 
gram implementation continues. 

Regarding third-party inspectors, DHS has implied that its exist- 
ing statutory authority allows their use. Policy issues include 
whether third parties should perform CFATS inspections and, if so, 
who might be appropriate, and how to harmonize training and in- 
spection standards. 

If CFATS program performance challenges arise from insufficient 
inspection capacity, third-party inspectors might help. If the chal- 
lenges arise from other factors, third-party inspectors might have 
little effect on performance. 

The Obama Administration has stated its support for inherently 
safer technologies to enhance security at high-risk chemical facili- 
ties. Currently, DHS cannot require a regulated facility to adopt 
specific security approaches or chemical process changes, including 
inherently safer technologies. A fundamental challenge is how to 
compare a technology with its potential replacement. 

Congressional policymakers might mandate the implementation 
or consideration of certain inherently safer technologies, or they 
might direct DHS to identify specific approaches. Alternatively, pol- 
icymakers might establish an incentive-based structure to encour- 
age regulated entities to adopt inherently safer technologies. 

To some extent, the CFATS regulation provides such an incentive 
since DHS might assign such facilities to lower-risk tiers. 

I will now summarize how H.R. 4007 compares with the existing 
statute. The bill incorporates much of the existing statute, but it 
also has key differences. Some examples are: The current statutory 
authority will terminate on October 4, 2014; the authority granted 
under H.R. 4007 would be permanent. 

The current statute does not specify how DHS should consider 
security risk. The bill directs DHS to use specific criteria when as- 
sessing chemical facility risk. 

The bill would expressly allow the Secreta^ to use third-party 
inspectors in the inspection process, and the bill would provide cer- 
tain limitations on the Secretary with respect to issuing a per- 
sonnel surety standard. These limitations would conflict with the 
current DHS personnel surety approach. 

Thank you for the opportunity to appear before the Committee, 
and I would be happy to answer any questions you might have. 

Senator Coburn. [Presiding.] Mr. Shea, thank you. Sorry for the 
back and forth. The votes will continue while we will do this. Ms. 
Fendley. 
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TESTIMONY OF ANNA FENDLEY,i MPH, LEGISLATIVE 
REPRESENTATIVE, UNITED STEELWORKERS 

Ms. Fendley. Good morning. Thank you for the opportunity to 
testify today. I am here on hehalf of the United Steelworkers 
(USW) International Union. Our 850,000 members include the ma- 
jority of unionized workers in the chemical industry and hundreds 
of thousands of men and women whose workplaces use and store 
large quantities of industrial chemicals. 

Our members are well aware of the hazards and the potential for 
widespread damage to critical infrastructure and the communities 
where they work and live. Small accidental releases occur more 
often than the public realizes, and it is only a matter of time before 
the next large explosion or release. 

Events in West, Texas, and at the Chevron refinery in Richmond, 
California, have brought acute national attention to the danger of 
chemical facilities and the need to prevent catastrophic events 
caused either by accident or by the intentional actions of terrorists. 

The CFATS program was an interim measure when the 109th 
Congress gave DHS statutory authority to regulate chemical facili- 
ties for security purposes. Since that time subsequent Congresses 
have continued to extend the authority to DHS for the program 
without addressing recognized problems with its implementation 
and scope. 

A legislative path forward needs to address the inherent weak- 
nesses of CFATS, five of which I will cite in detail today. 

First, CFATS coverage does not extend to chemicals shipped or 
stored outside of a facility’s fence line in nearby rail yards or else- 
where that may have little or no security measures. Currently 
CFATS does not prevent and DHS does not systematically docu- 
ment whether chemicals and the risks associated with them are 
merely shifted from one location to another. 

Second, DHS is prohibited from requiring a CFATS-covered facil- 
ity to use any particular security measure, including a fence in a 
particular area, a specific control on a unit, or any other measure 
that is well documented through past practice in the industry. 

Third, CFATS should develop and promote the most effective 
means of preventing a chemical incident, which is reducing the po- 
tential consequences by using safer chemical processes. DHS, the 
Environmental Protection Agency, and the U.S. Chemical Safety 
Board (CSB) have cited the effectiveness of assessing and, where 
feasible, implementing safer processes at high-risk facilities. 

According to a report from DHS, since the inception of the 
CFATS program nearly 1,900 facilities have removed or reduced 
their chemicals of interest. But many companies will never even 
look into innovating with safer processes without a legal require- 
ment to do so. 

Fourth, many have expressed concerns today about duplication of 
efforts and the burden for multiple background checks under the 
Personnel Surety Program. The Transportation Worker Identifica- 
tion Credential is an option to use under CFATS. Many of our 
members have successfully obtained a TWIC card, but it is not 
without some concerns. 


^The prepared statement of Ms. Fendley appears in the Appendix on page 87. 
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Another concern about personnel surety is that CFATS does not 
prevent the collection of unnecessary personal employee data by 
employers or third parties. There is not an adequate appeals proc- 
ess for workers who are wrongly discriminated against during the 
personnel surety process. In a February 3 Federal Register notice, 
DHS stated that employment decisions based on background 
checks are outside of the scope of CFATS and that DHS expects 
employers to comply with applicable Federal, State, and local law 
regarding employment and privacy. 

Workers are seeing DHS apathy about their jobs play out in fa- 
cilities across the country. In fact, one of our local unions recently 
received a letter from their employer that said, “Although [our com- 
pany] and its representatives are not required to notify its employ- 
ees or union leadership of this requirement prior to conducting 
background investigations, we believe it is a prudent and a good 
business practice to do so.” 

Not all employers will do the right thing by telling their employ- 
ers about new security measures without a requirement. On the 
whole this is inadequate. Workers need to be informed about secu- 
rity measures, including background checks being performed on 

them, and workers need an appeals process should they be unjustly 
disqualified from their job due to an employer-conducted back- 
ground check. 

This brings me to my fifth point. CFATS lacks the requirement 
for a meaningful role for workers in chemical security. It is our ob- 
servation that DHS stakeholder engagement with industry is fre- 
quent and productive. However, DHS does not adequately engage 
workers and their representatives either at the Federal level or 
within a facility. Workers at facilities would be hurt first and worst 
in an attack. CFATS should require meaningful involvement of 
plant employees in developing security plans and provide whistle- 
blower protections for those who engage in the process. At a very 
minimum this could help DHS identify facilities that are covered 
by CFATS but are not complying with its requirements. 

In closing, any legislation authorizing the program must be re- 
sponsive to the identified shortcomings and challenges of CFATS. 

Thank you again for the opportunity to testify today. 

Senator Coburn. Mr. Scott. 

TESTIMONY OF TIMOTHY J. SCOTT, i CHIEF SECURITY OFFI- 
CER, THE DOW CHEMICAL COMPANY, ON BEHALF OF DOW 

AND THE AMERICAN CHEMISTRY COUNCIL 

Mr. Scott. Chairman Carper, Ranking Member Coburn, and 
Members of the Committee, I am Tim Scott, chief security officer 
and corporation director for emergency services and security at 
Dow Chemical. I am here today representing Dow and the Amer- 
ican Chemistry Council. 

The security of our Nation’s chemical industry has been in the 
media, legislative, and regulatory spotlight since 9/11. But indus- 
try’s efforts to be a safe and secure partner in the communities 
where we operate and transport our products started well before 

then. 


^The prepared statement of Mr. Scott appears in the Appendix on page 92. 
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When DHS was given the authority to regulate the chemical in- 
dustry relative to security, the industry was an active and enthusi- 
astic partner in the development of the Risk-Based Performance 
Standards. The Responsible Care Security Code matched these 
standards in many areas and is a mandatory requirement for the 
American Chemical Council (ACC) membership. 

The launch of DHS, CFATS, and the Responsible Care Security 
Code is a successful example of what defines a partnership: every- 
one working toward a common goal, perhaps in a different manner, 
but with one focus. 

During that time and still today, ACC is very proactive in sup- 
porting CFATS legislation in order to bring everyone to the table. 
The launch of DHS and CFATS was tenuous at first, but it is suc- 
cessful based on a partnership approach with open communication. 
Through the last few years, the implementation became difficult for 
many reasons. The communication and the partnership was 
strained. I am here today to say that we have turned the corner 
and we are once again on the right path. The partnership is work- 
ing. Progress is being made, and the security of the chemical indus- 
try is stronger today than ever before. 

There have been many positive developments over the last sev- 
eral months with the most significant being the progress toward 
multiyear authorization for CFATS. A multiyear authorizorization 
puts DHS and CFATS closer in line to the industry’s capital plan- 
ning process and allows for some certainty for industry to take ac- 
tion. 

A multiyear authorization also brings stability to DHS in plan- 
ning and implementing CFATS and also in staffing to be sure that 
the necessary expertise is in place and will remain in place to ac- 
complish the mission. 

Maintaining the original premise of Risk-Based Performance 
Standards and allowing individual sites the flexibility to determine 
the local solution that will meet the standards also spurs progress. 

No two sites are the same, but all must meet the same goal. This 
flexibility allows each unique site to identify the solution that 
meets the performance standard in the best manner for that site, 
and improving security to meet the performance standard is the 
goal. 

We are not done. Industry, DHS, and this Committee are not 
done. We are making progress, but we need to complete the mis- 
sion. We need to fine-tune the personnel surety process so that it 
adds value to all concerned. We need to share critical information. 
We need to ensure that risk is being determined in a fair and con- 
sistent manner. And we need to leverage the plethora of industry 
security programs that are already in place today such as the ACC 
Responsible Care Program. 

We have improved communications between DHS and the sites, 
but we need to do more. We need to give the regulators the re- 
sources needed to ensure compliance, to understand the regula- 
tions, understand how the industry works, understand the sites 
and their area of responsibility, and visit those sites on a regular 
basis. And industry needs to challenge our peers. We need to self- 
regulate and bring everyone included in what is considered the 
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chemical sector into the process. And we need to include the com- 
munities around our sites and along our transportation routes. 

CFATS is making the chemical industry more secure. DHS is 
maturing and finding its balance and reaching its goals. Industry 
is doing its share, but we are not done. A multiyear reauthorization 
and a commitment to continue the partnership in a risk-based ap- 
proach are essential. 

Just as important, we need to bring all the players to the table 
to work toward our common goal. We are not there yet on either 
the public or the private sector sides. We are encouraged by the 
progress being made, but we need your help in maintaining this 
forward momentum. 

Thank you. 

Senator Coburn. Thank you. 

Senator Johnson, I am going to let you go first since I am going 
to go late to the vote. 

Senator Johnson. Thanks, Senator Coburn. 

Mr. Scott, I really want to explore private sector cooperation in 
terms of achieving that goal, that shared focus that you were talk- 
ing about. I would imagine Dow Chemical is ISO certified? 

Mr. Scott. Yes, sir. 

Senator Johnson. Do you believe within that framework you 
could utilize the surveillance audits of certification of ISO to work 
in coordination with what we are trying to do here with CFATS? 

Mr. Scott. Yes, sir, it would be a very good fit, very close fit, and 
it would be a good foundation for the whole process, yes. 

Senator Johnson. Can you just talk about, as a private sector 
company, the duplication of audits of certification, of, whether it is 
insurance, whether it is ISO, whether it is the multiple regulatory 
agencies you comply with and the cost of that duplication? 

Mr. Scott. There is a significant amount of overlap, and on secu- 
rity, on CFATS alone, we, Dow Chemical, have spent about $300 
million on a global basis. Now, probably about half of that or two- 
thirds of that has been spent in the United States, but we imple- 
ment everything on a global basis. So to our company at least, it 
has been significant. 

Senator Johnson. How much would you have spent without 
CFATS? Just because you recognize within the private sector your 
insurance ratings, insurance expenses, how much do you think you 
would have spent without CFATS? 

Mr. Scott. Well, it would probably be a little bit less, but we im- 
plement the Responsible Care Code, and it does very similar 
things. We tier our sites, and, again, we implement the Responsible 
Care Code on a global basis. So our higher-tier sites under Respon- 
sible Care already have a higher level of security in place. 

CFATS brings some more specifics focused on things like the ve- 
hicle barricades at gates that need to be in place, so there would 
be some difference. But CFATS does add some cost, but Respon- 
sible Care implementation also adds some cost, and we have been 
moving to bear that. 

Senator Johnson. Let me move on. You talked about the Amer- 
ican Chemical Council. There are certain standards that you have 
to meet just to be a certified member of that, correct? Can you just 
speak to those a little bit? 
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Mr. Scott. The Responsible Care standards are very strict. You 
have to implement Responsible Care across the board at your sites 
in order to be a member of ACC. It is audited. You do a self-assess- 
ment audit on an annual basis. You have external auditors on a 
3-year cycle. So we look at the whole picture of the Responsible 
Care Codes, which includes things in my area, obviously, are secu- 
rity, the Responsible Care Security Code, but we also have codes 
that are specific to transportation security, transportation emer- 
gency response, site emergency response, which includes — those in- 
clude the Community Awareness and Emergency Response pro- 
gram, plus the Transportation Community Awareness and Emer- 
gency Response (TRANSCAER) program for transportation emer- 
gency. So it is an all-inclusive code. 

Senator Johnson. What has happened to those standards since 
September 11, 2001? 

Mr. Scott. We have added the Security Code, it was added after 
9/11. The rest of those codes were in place well before 9/11. I think 
we have bulked up a lot of them. We have gone back and looked 
at the details and added some specifics around particularly trans- 
portation. There is a process safety piece to the Responsible Care 
Codes that we have now linked that with the Security Code, so we 
can do vulnerability assessments from both a security perspective 
and a process safety perspective. So I think we have built on what 
we already had in place to make it stronger. 

Senator Johnson. Dow Chemical is obviously one of the big guys. 
Are you concerned about your distribution system, your smaller 
customers, your smaller suppliers and their ability to — obviously, 
you have the financial wherewithal to spend money on this. Can 
you speak to the difficulty maybe smaller companies, smaller sup- 
pliers are having trying to comply with this? And do you have any 
solutions? 

Mr. Scott. Solutions. 

Senator Johnson. Just start background the problem. 

Mr. Scott. I will start with the problem first. Yes, smaller com- 
panies find it very difficult to meet some of the standards in place 
just because of the size and the cost of the standards that are in 
place. But I think as we heard with DHS, they are doing a very 
good job of going out and working with people that — especially the 
smaller companies, to find a reasonable approach to upgrade the 
level of security. So I think there has been a lot of progress made 
working with that. 

Many of the associations — ACC and the other industry associa- 
tions — have been out working with their member companies to 
work through the whole process. I think that has been helpful. 

There is a cost involved, and there are a lot of companies, small 
companies out there, that do not belong to a member company. 
Dow works through its supply chain network and its customer net- 
work. So we work on both ends, not just at our sites but on the 
transportation routes and our customers and our suppliers and 
those who carry our products. So we work very closely with all 
those companies to make sure they are meeting the standards. 

Senator Johnson. Dr. Shea, Ms. Fendley talked a little bit about 
background checks. I would like you to address the problem that 
employers have when they are kind of caught between a rock and 
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a hard place trying to comply with a regulation, from one agency 
and then privacy concerns and employment law on the other. Can 
you speak to — how does business deal with those? 

Mr. Shea. I think there have heen several concerns that have 
heen raised in the context of personnel surety here. One is regard- 
ing information and its sharing from the Federal Government down 
to companies. The other one is related to the employees themselves 
knowing the results of any sort of background check that is per- 
formed. And then the third one, which was brought up earlier in 
this hearing, is about whether or not, if you have already under- 
gone a background check under one program, should you also then 
undergo some sort of vetting to either validate the credential that 
you have or to be certified under another program. 

The Department of Homeland Security has said that the infor- 
mation sharing that it would be doing would not be necessarily to 
a facility but potentially to local law enforcement. Similarly, the in- 
formation that it would have about positive hits in its database 
may not be provided back to a person that is being vetted. The 
proper recourse from their perspective is either an intelligence- 
based one or a law enforcement-based one. 

Of course, as probably Mr. Scott can refer to, the stakeholders 
believe that this information is information that is important to 
them, either for business decisions or potentially for liability. And 
so the personnel surety proposal that DHS has put forward, stake- 
holders have had a series of concerns and wish DHS to modify it 
in a variety of ways. 

This proposal, as was pointed out by DHS, has gone through two 
comment periods, actually, and is now up in front of 0MB for final 
determination. 

Senator Johnson. But specifically I want you to address employ- 
ers trying to comply with CFATS. Are they vulnerable? Are they 
going to be subject to lawsuits in terms of employment discrimina- 
tion? What kind of vulnerability exists there? And how can you ad- 
dress that? How can we prevent that? 

Mr. Shea. I think that is a very challenging problem, and it 
probably falls into the area of legal counsel and determinations by 
general counsel. That would be out of the scope of what I would 
really be able to discuss. 

Senator Johnson. Ms. Fendley, you raised the issue which raised 
the question in my mind. Can you speak to that a little bit? 

Ms. Fendley. Sure. I think that the most important thing that 
we are looking for is some transparency. As the letter I referenced 
that one of our local unions received from its company said, they 
feel like they have no obligation to even tell their employees that 
they are going to be undergoing background checks due to their 
CFATS Site Security Plan. And any employment decision that 
would result in a worker getting fired, if that worker had a local 
union, certainly that would be challenged and questioned. But 
many workplaces do not have unions, and workers could potentially 
be fired and not understand why. 

Senator Johnson. Well, even non-unionized workers have re- 
course through the courts, and that is the problem I am having 
with the regulations requiring that. Again, employers end up being 
just in an impossible situation. But I am over time. Thank you. 



36 


Senator Coburn. I will submit the majority of my questions to 
the record since we have about 4 minutes left on this vote, Ron, 
if you want to take off. 

Transparency is key, I agree with you. But the fact is if some- 
body has to pass a CFATS personnel surety check and they cannot 
pass it, what is the legal basis — if there is transparency — for a suit 
against somebody for not allowing that person to have that employ- 
ment, if they cannot meet the requirements that the government 
says? 

Ms. Fendley. I agree with you, and I think that you make a very 
accurate point. I think what we are concerned about is decisions 
that are made due to inaccurate information, whether we hear all 
the time reports about people’s credit checks or criminal histories 
being inaccurate. And what is the recourse for someone who gets 
an adverse employment decision based upon inaccurate informa- 
tion? I recognize, we all recognize the hard place that employers 
are in in this case, and we really want to work with DHS and with 
industry to get to a solution that works for everyone. 

Senator Coburn. All right. Thank you. I will submit the rest of 
my questions for the record. 

Chairman Carper. [Presiding.] All right. Thanks, Dr. Coburn. 
Sorry to be gone for so long. The first vote, they stretched it out 
27 minutes. It is supposed to be 15 or 20. 

Anyway, I am back so I missed the questioning that took place. 
I think what I would like to ask is — one of the things I like to do 
at these hearings is we have a diverse panel here, and we need 
help in developing consensus. I said earlier that I very much would 
like to see us authorize the CFATS program, not permanently, 
probably not for 5 years, but certainly for more than zero, which 
is where we are right now. 

Would you just talk with us about why it is important from your 
perspectives for the Congress to do something, not just anything 
but something constructive, and what might be most important in 
that something constructive for us on our to-do list as we approach 
authorization, reauthorization of this program? Do you want to go 
first. Dr. Shea? 

Mr. Shea. Certainly. So with regards to concerns about the pro- 
gram, as has been pointed out previously, the duration of, or actu- 
ally if there would be, any reauthorization of the program has been 
brought up both by stakeholders and by the agency itself in terms 
of providing consistency and a sense that the program would be an 
enduring program. 

The current proposal in the House would be a permanent author- 
ization with a 3-year authorization of appropriations. The Presi- 
dent has requested in his budget a 1-year extension of this author- 
ity. So, there is a range of potential durations for any potential ex- 
tension that Congress might want to put into place. 

The longer that that duration is, then the more constancy the 
program might have. On the other hand, the shorter that reauthor- 
ization period is, the greater the potential for Congress to come 
back and review how the program is going because of these dead- 
lines. 

The program has been extended essentially in 1-year increments 
through the appropriations process. That has, since the original 
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statute was put in place, caused Congress to come back and look 
at this basically in each Congress. I think one might be able to 
make a strong case that a medium-term or a short-term authoriza- 
tion would increase congressional oversight on the progress. 

I think the other issue that has come to the fore is about the rate 
of implementation. Part of this is, I believe, a question of what is 
the intent of Congress regarding how quickly this program should 
be fully in place. During the time that the original statutory au- 
thority was provided, there was a sense that this needed to be in 
place rather quickly with the 6-month requirement for the interim 
final rule. As we heard earlier today, DHS is projecting at least 
multiple years before they will reach completion on the first round 
of these facilities. So direction from Congress about how long this 
process should take might assist them in their priorities. 

Chairman Carper. iUl right. Thank you. 

Ms. Fendley, I notice you have a Ph.D., we have Mr. Scott, and 
he has nothing after his name; and for you we have a Master of 
Public Health “(MPH).” And I turned to my staff, and I said, “Is 
that ‘miles per hour’?” They said, “No. It might be ‘Master’s in Pub- 
lic Health.’” I do not know. What is it? 

Ms. Fendley. Yes, sir, that is what it is. 

Chairman Carper. All right. Fair enough. 

Well, speaking of miles per hour, we are trying to move into the 
fast lane as we move toward some kind of authorization here. At 
least we get off the curb and move us down the road to help us 
with that. 

Ms. Fendley. Wonderful. So I think from our perspective, the 
most important thing that Congress could do when looking at, au- 
thorizing the program is find a way to protect the workers at these 
sites. Ultimately this does affect conditions of work, and workers 
who report a security vulnerability do not have whistleblower pro- 
tections. As I mentioned in my testimony, there are concerns with- 
in the Personnel Surety Program, and workers are not involved by 
DHS or their employers in the development of these plans, which 
we think harms security. We think workers really understand bet- 
ter than anyone else the vulnerabilities at a site and what can be 
done to prevent a catastrophic incident. So those would be our top- 
line items for your to-do list. 

Chairman Carper. All right. Thank you. Mr. Scott, are you here 
representing Dow? 

Mr. Scott. Dow Chemical and the American Chemistry Council. 

Chairman Carper. And how long have you been with Dow? 

Mr. Scott. Thirty-five years. 

Chairman Carper. Did you start right out of school? 

Mr. Scott. No. I started right out of the Navy. 

Chairman Carper. Oh, really? What did you do in the Navy? 

Mr. Scott. I was on the first crew of the USS Nimitz, which is 
now the old nuclear aircraft carrier. 

Chairman Carper. How about that. Good for you. I once took a 
bunch of Boy Scouts down to Norfolk Naval Station. My sons were 
both Scouts, and had about, 20 or 25 Scouts and some adults with 
them, and we visited the Theodore Roosevelt. This was about 6, 7, 
8 years ago. And it was a Sunday morning, and the captain of the 
ship was there to greet us, took us up to the conning tower, and 



38 


we were talking with him. He was talking with us about our hoys 
and about what the Roosevelt could do, and he said, “Boys, when 
our ship goes to sea, it is a thousand feet long.” The boys went, 
“Oooh.” He said, “When the Roosevelt goes to sea, we have 5,000 
sailors on board.” And the boys went, “Oooh.” And he said, “And 
when the Roosevelt goes to sea, we have 75 aircraft on board.” And 
the boys went, “Oooh.” 

Then he said, “And the USS Roosevelt” — which is a nuclear ship. 
“The USS Roosevelt stops to refuel every 25 years.” And the adults 
went, “Oooh. Very impressive.” 

So talk to us, if you will, please? 

Mr. Scott. The Roosevelt is a Nimitz class carrier, that is right. 
And I apologize. A lot of people put things after my name, but I 
do not put them out there to 

Chairman Carper. Some put things before my name. [Laughter.] 

Mr. Scott. There you go. 

Chairman Carper. It is probably better to have them after your 
name. 

Mr. Scott. We talked a little bit about the extension and the 
length of the extension, and that is a critical point for industry and 
for DHS, just to provide some certainty. And I think it is certainty 
for industry so they know that the program is going to be in place. 
But it is also certainty for DHS. And 3 years is the minimum to 
really match up with the capital planning process for industry. If 
you tell me today I have to go do something, I will get the money 
next year and probably finish the project the year after that. So, 
3 years is the minimum as far as working with industry and mak- 
ing it a little bit easier to do the planning process. So three is good, 
four is better. 

But it is also certainty for DHS. They have had a lot of people 
moving in and out of DHS and change jobs, and I think part of the 
issue is that there is no certainty in DHS that DHS is going to be 
in existence, that CFATS is still going to go on. And that hurts the 
whole process when we have a lot of changeover in personnel. 

So I think that is a key benefit for them — nothing to do with 
CFATS, the process itself, but just with maintaining personnel and 
qualified personnel and keep them in place long enough to get the 
job done. 

The other thing that I would like to clarify just on the Personnel 
Surety Program, there are two pieces of this: The background 
checks is one piece, and that is the typical background check on the 
criminal history, anything that might keep you from being a good 
employee at the site. And there are processes in place for people 
to talk about that because things that happen when you are 18 
years old and you are now 40 are different things. So I think that 
part of the process has been in place in most companies, as a mat- 
ter of fact — for many years, and that process is working through. 

The issue on this one, in my opinion, is the terrorist database 
screening, so you separate those two, and industry can and has al- 
ways typically done background checks, some specific to industry, 
some specific to a site. But, in general, they cover the same things. 
But the new edition is a terrorist database screening, and only the 
government can do that. 
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So you have to submit the information to DHS or you use a proc- 
ess like the TWIG card that is already there. Everybody going out, 
especially small sites, going out and buying the equipment to im- 
plement the TWIG process is expensive and burdensome for some. 
We could do that at some of our smaller sites. We already do it at 
our MTSA sites. And that lets you see if this TWIG card still 
works. Then you know they have passed the terrorist database 
screening, and that is what we need to know for this sort of thing. 

There are also other credentials out there that if you validate 
that they are still current, they have also gone through a terrorist 
database screening, and those ought to be approved. But then there 
are some people that do not have any of that, and the site would 
have to submit that information to get the clearance and the ter- 
rorist database screening, which is essential to good security. 

The issue that I have is we never get a yes or a no from DHS. 
We do not give any — they do not issue a card. You just submit the 
information. Then you let the person go to work. And what I have 
asked for is, if somebody — just like the airlines, if there is some- 
body that is on the no-fly list, they cannot get on the airplane until 
they get the letter that says, “No, this is the wrong John Doe. This 
one is good to go.” 

There needs to be that process in place so that we can be sure 
that everybody that is coming into our site does pass the terrorist 
database, and if there is somebody on the terrorist database list, 
there is a stop, a hold in place, until we get it cleared up. So that 
is the issue as far as the background, the personnel surety. It is 
the terrorist database screening and getting that information com- 
municating between industry and DHS to get a hold versus just 
send in the information, let the person go to work, and we do not 
know if he is on it or not on it. 

Ghairman Garper. All right. Of the audience — I do not normally 
ask questions of the audience, but I am going to ask a question. 
Anybody still here from DHS? Oh, good. I hope you took good notes 
on those comments, and that could be very helpful in terms of mov- 
ing us along in a smart way. Thank you. 

The other thing I wanted to ask of all of you is just sometimes 
I will say, when we are looking to build consensus on an issue, you 
had an earlier panel that spoke, and I thought that was construc- 
tive, the interaction there with them. But think back on some of 
the conversation and reflect anything you want to reflect on, on 
what was said or maybe not said, maybe in their statements or in 
answering our questions, just some things that we should be mind- 
ful of that you agreed with, maybe did not agree with. Please. 
Some things you would like to underline, put an exclamation point 
at the end? Please. 

Ms. Fendley. Sure. So there are two things that came to mind 
when I was listening to the first panel. The first speaks to a point 
I have made multiple times, and that is when DHS talked about 
their stakeholder engagement, it was always stakeholder engage- 
ment with industry. And we would like to underline the point that 
workers, labor, is also a key stakeholder here, and we have not 
been engaged as much as we would like, we have not been able to 
do that with DHS, either at the Federal policy level or at the facil- 
ity -by-facility level. 
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The second thing that I would underline is, due to the backlog, 
due to the slow approval of Site Security Plans, our members are 
just now seeing and reporting in a few cases where the sites are 
beginning to implement plans. So we are hopeful that the flexibility 
within the program can continue because we want to make sure 
that these plans actually work. I do not think we are — as someone 
said, we are not — I believe it was you. Chairman — at the end zone 
yet, we are not even in the red zone. These plans are just begin- 
ning to be implemented, and we are just seeing the effects on work- 
ers at these sites. 

Chairman Carper. All right. Thank you. I am probably not the 
first to have said that. I am the first one that said it here today, 
so I will take credit. 

Others, just reflecting back on the first panel, what was said, 
maybe on what was unsaid. 

Mr. Scott. I would say there are more positives now than nega- 
tives, which is a great sign. I think the fact that they are recog- 
nizing — DHS is recognizing Alternative Security Plans makes it 
easier on everybody, especially the smaller companies. 

Chairman Carper. I thought that was a good takeaway. 

Mr. Scott. They are doing a great job there, and the various as- 
sociations are helping the smaller companies by developing Alter- 
native Security Plans that they can get out. So there is a good 
team effort there. 

I think the inspectors that are coming onsite now, it is more of 
a partnership approach, coming up with the right solution for each 
particular plant instead of coming in with a cookie-cutter approach, 
and that is significant progress. And I think the number of inspec- 
tors that they have out in the field now is increasing. So I think 
that is — the good news is I think the positives are outweighing the 
negatives as far as the implementation. I mean, everybody is still 
not happy that we are not farther along, but we are making a lot 
faster progress than we were in the past. 

Chairman Carper. Good. My staff was good enough to give me 
some questions I might want to consider asking. You just answered 
one without my asking it, so very good. 

Mr. Shea, anything you want to reflect back on the first panel? 

Mr. Shea. Certainly. The Department has talked about how it is 
currently undergoing a process to assess the recommendations for 
the way that it calculates risk. One of the things that has hap- 
pened in the past when anomalies were discovered in the way that 
they calculated risk for facilities was that facilities changed risk 
tiers underneath the CFATS program. So, when DHS does imple- 
ment whatever changes it makes to the way that it considers facil- 
ity risk, regulated facilities might find themselves in a different 
risk tier. If you are moving from a lower to a higher tier, that 
might lead to your facility incurring more security costs; and, of 
course, if you are going from a higher-risk tier to a lower-risk tier, 
potentially lower security costs. 

This, of course, would have an impact on the facility itself. How 
DHS rolls that process out and how it considers the costs of imple- 
mentation may be something to look at. 

Chairman Carper. All right. Thank you. 
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One last question, if I can. I am going to ask this to Mr. Scott 
and to Dr. Shea. As I think we discussed earlier, DHS reports that 
roughly 3,000 chemical facilities around the country have tiered 
out of the program by removing or modifying or reducing the 
amount of chemicals of interest in their processes at their facilities. 
Do either of you have any more specific information about these fa- 
cilities and how they did that or maybe you have some examples 
from Dow or some other place? But do you believe that we ought 
to be gathering some best practices from these facilities, maybe 
even ask GAO for a review and looking at those 3,000 a bit more 
closely to see what we can learn from them? Mr. Scott. 

Mr. Scott. Well, a lot of the changes were in inventory, the 
amount of the chemical of interest that you have onsite or that you 
use in the process. So I think that is one of the bigger reasons that 
made people move down in the tiering process. 

There are some that just by changing the percentage, the chem- 
ical makeup of a product, has taken it out of the process. So there 
are some things like that. 

I think there are some sites that we have just moved out of. The 
site for whatever reason — I mean, typically there is a business rea- 
son. Then you add security to it, and we have moved away from 
that site totally now. I know that has happened. And then there 
are other places where we have moved the process from one area, 
for example, in the Houston Ship Channel, which is a high popu- 
lation area, and a plant is an old type of manufacturing process, 
open-air type of manufacturing process, and we have moved it to 
our Texas operations area, which is south of Texas, and put the 
process into our new design process, which we use on a global 
basis, which is a fully contained — the part of the process that is 
critical, that has a chemical of interest, is fully contained in a pres- 
surized container. So the safety is much higher for that particular 
site. So it is a combination of all of the above that really makes 
it work. 

Chairman Carper. Good. That is helpful. 

Mr. Shea, just briefiy, and then we will wrap it up. 

Mr. Shea. I think to the extent that DHS has been following why 
these 3,000 facilities or how these 3,000 facilities have modified 
their holdings, I think that might be very enlightening. Whether or 
not they, for example, have not changed any of their processes and 
just, as has been pointed out, gone to a lower amount stored. This 
brings in this question of risk shifting that was addressed by the 
Committee earlier. The amount of risk that is contained in trans- 
porting chemicals more frequently, is that offsetting the risk that 
is reduced by having less at the facility? 

But the other issue that I would raise here is that the chemical 
industry has regularly said that these sorts of chemical process as- 
sessments are done as part of their business model. Then when 
they look at their process, they try to determine whether or not 
there is a different way that would be safer for them and cost-com- 
petitive with what they are doing. To the extent that that informa- 
tion is core to their business model, the sharing of that information 
may provide competitive advantage to their competitors who have 
not undergone as effective or efficient a process. 
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Chairman Carper. OK. Well, our third and last vote for the 
morning is underway — actually, the morning is over — and so I am 
going to slip off and do my constitutional duty to vote. 

I had come here today hoping that we would hear from the first 
panel and the second panel and from my colleagues just a good ex- 
change of ideas and information that would enable us to actually 
make some progress on cobbling together an authorization bill, a 
multiyear authorization bill that we could get strong support for 
here that Dr. Coburn and I might be able to support together. And 
this has been helpful. I thank you as well. 

We are fortunate in our State that we have — Dow is one of our 
corporate citizens. They acquired Rohm and Haas several years 
ago. Rohm and Haas had acquired a company called Rodel, a great 
company. And so we are blessed with Dow in our State and grate- 
ful not only for the employment opportunities they provide but 
really for the good that they do in our State. And I know that is 
true in other places around the country, so a special thanks to your 
compadres at Dow. 

I am going to ask our staffs, both Senator Coburn’s staff, a key 
staff person on this issue, and several people on ours, just to stay 
together for a few minutes back in the anteroom and just reflect 
on what we have heard and talk about how we might build on this 
conversation going forward. 

The hearing record will remain open for 15 days — that is, until 
May 29, 5 p.m. — for the submission of statements and for questions 
for the record. And if you would hand me that gavel over there — 
would you just do a favor for me, just like bang it? With that, our 
hearing is adjourned. Thanks so much. 

[Whereupon, at 12:14 p.m., the Committee was adjourned.] 
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Opening Statement of Chairman Thomas R. Carper 
Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program 
May 14, 2014 


As prepared for delivery: 

This morning we will be discussing the Chemical Facility Anti-Terrorism Standards program, 
also known as C-FATS. This program was established to secure our nation’s high risk chemical 
facilities from attack, sabotage, and theft. 

These facilities, and the chemicals they hold, could pose significant risks to our communities if 
they were exploited by those who seek to do us harm. 

Because of the vital importance of chemicals to our economy, they can be found in nearly every 
community in the United States. 

Congress has decided - correctly in my view - that we cannot leave the security of these 
facilities to chance or the good intentions of only the most responsible companies. 

Since 2007, DHS has woriced to identify which chemical facilities pose die greatest risk, and 
push those who manufacture, store, and use them to put adequate security measures in place. 

This was not a simple assignment. Perhaps not surprisingly, the implementation has been 
challenging. 

There have been significant missteps to date - including analytical mistakes and some 
management failings. 

In fact, an internal DHS memo leaked to the news media in Decemlwr 201 1 detailed a number of 
bad practices, such as the purchase of equipment and vehicles the program didn’t need. 

The program was also slow to start approving facility site security plans. The approval of these 
plans is a crucial first step before DHS can begin inspecting facilities to ensure they comply with 
security regulations. This is where the rubber meets the road for this program so any 
unnecessary delay is troubling, 

But the good news is that that’s not the end of the story. 

That leaked internal memo was the result of leadership within DHS recognizing problems, and 
being determined to get this vitally important program on track. And since that review, 
increased scrutiny from Congress, coupled with high level attention from DHS leadership, has 
helped to turn things around. 

Over the past year, DHS has authorized and approved hundreds of security plans. 
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To date, more than 3,000 facilities have eliminated, reduced, or modified their holdings of 
dangerous chemicals, making them more secure from attack, and making the communities that 
surround them safer too. 

DHS has made these strides. I’m told, through a productive partnership with the chemical 
industry. 

Key industry partners support reauthorizing the program and have worked with DHS to devise 
solutions to some of the implementation problems that have emerged. 

While there’s good news here, there’s still a lot of work to be done. 

Despite the Department’s accelerated pace for reviewing security plans and facilities, there 
remains a backlog of facilities awaiting inspection. 

GAO and other experts have also expressed concern that the Department’s method for assessing 
risk for a chemical facility is incomplete. Specifically, more and better information must be used 
in conducting these assessments. 

And the explosion at the West Texas Fertilizer Company plant a year ago showed that, in some 
cases, the Department likely isn’t aware of some facilities that should be submitting information 
to the program but are not. 

As some of you may have heard me say before, “If it’s not perfect, make it better.” So I believe 
our goal today is to figure out what we. Congress, can do to make the Department of Homeland 
Security’s chemical security efforts better. 

I think we should also recognize that Congress’ failure to provide a long-term authorization has 
not provided the Department with the stability it needs to make the program as good as it could 
be. 

In fact, because the program’s authorization only occurred as part of an annual appropriations 
bill, it ceased to exist for a short time during the government shutdown last fall. 

That created confusion and uncertainty not only for the Department, but also for an industry that 
has invested millions of dollars in security and compliance. 

A few weeks ago the House Homeland Security Committee took action to mark up a bill to 
authorize the C-FATS program for the next three years. 

I understand that legislation was supported not only by the Department and by industry, but was 
approved by a bipartisan voice vote after a great deal of work from both Republicans and 
Democrats. 
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I think a bill that can bring those various stakeholders together is one that this committee should 
examine closely, take seriously, and perhaps use as a model for our work on this issue between 
now and the end of the year. 

I look forward to hearing from our witnesses today about their thoughts on the House bill and 
what we here in the Senate should be thinking about as we work to make this program more 
effective, and our communities safer. 
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Opening Statement of Sen. Tom Coburn 
“Charting a Path Forward for the Chemical Facilities 
Anti-Terrorism Standards Program” 

Wednesday, May 14, 2014 

Good morning and welcome, 1 want to start by telling you how enthused I am with the leadership 
at DHS and the changes that are occurring, particularly with the Secretary. I also congratulate 
Under Secretary Suzanne Spaulding and Director David Wulf in terms of the improvements that 
are being made with the Chemical Facility Anti-Terrorism Standards (CFATS) program, and I 
mean that very sincerely. 

But the CFATS program is one of the programs that deserve a robust review from DHS and this 
Committee. Since 2007 we have spent nearly $600 million on the program, and less than 2 
percent of the facilities have had a compliance inspection. And in my review of the program, I 
have learned some problems with the program. 

One is that CFATS is not significantly reducing the risk that terrorists will use chemicals to 
conduct attacks against the United States. 

The second thing is that the approach to assessing risk in chemical facilities which guides the 
CFATS program is broken. 

Third, DHS is far behind in meeting its deadlines in this program, reviewing security plans and 
inspecting facilities, which is not to say Mr. Wulf has not made a lot of progress; he has, and 1 
commend him for the progress he has made with CFATS, 

My fourth criticism is there is not enough work with the private sector or security experts to fix 
the problems in the program. 

My fifth criticism is that too much time and effort is spent on administrative aspects of the 
program that do not improve chemical security. The requirements for other chemical regulations 
like the Coast Guard’s Maritime Transportation Security Act Program, the Environmental 
Protection Agency’s Risk Management Program, and the Transportation Security 
Administration’s Pipeline Security Branch, do not come close to the requirements for CFATS. 

It cannot be that complicated. As a matter of fact, in talking to industry I know it is not that 
complicated. We need to fix CFATS before we make it permanent, and that is what 1 intend to 
do. We have got to look at this program and fix it. 

i look forward to your testimony, and I thank you for being here. 
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Testimony 

The Honorable Suzanne E. Spaulding 
Under Secretary 

National Protection and Programs Directorate 
Department of Homeland Security 

Director David Wulf 

National Protection and Programs Directorate 
Department of Homeland Security 

Before the 

Committee on Homeland Security and Governmental Affairs 
United States Senate 

May 14, 2014 


Thank you. Chairman Carper, Ranking Member Cobum, and distinguished Members of the 
Committee. I appreciate the opportunity to appear before you today to discuss the Department of 
Homeland Security’s (DHS) regulation of high-risk chemical facilities under the Chemical 
Facility Anti-Terrorism Standards (CFATS) and the importance of authorizing the program. 

Over the past two years, the CFATS program has made significant progress, advancing 
programmatically while simultaneously addressing internal management concerns. We are 
pleased to appear before you today to discuss authorizing the program and ensuring that DHS 
has the authority to carry out the program in a manner that will foster the security of America’s 
highest-risk chemical infrastructure. 

As you are aware, the Department's current authority under Section 550 of the Fiscal Year 2007 
Department of Homeland Security Appropriations Act, as amended, is set to expire in October 
2014. DHS is eager to work with the Committee and our stakeholders both in government and 
the private sector to achieve passage of legislation that provides long-term authorization and 
appropriately matures the CFATS program. In support of this collaboration, our testimony 
focuses on the progress made over the last two years, our efforts to continue strengthening the 
program, and the need for permanent authorization in order to fully stabilize the program. 

CFATS Has Made the Nation More Secure 

The CFATS program is an important part of our Nation’s counterterrorism efforts as we work 
with our industry stakeholders to keep dangerous chemicals out of the hands of those who wish 
to do us harm. Since the CFATS program was created, we have engaged with industry to 
identify and regulate high-risk chemical facilities to ensure they have security measures in place 
to reduce the risks associated with the possession of chemicals of interest. Interagency partners 
have benefited from this information as it has enhanced law enforcement cooperation with high- 


1 



48 


risk chemical facilities. CFATS has also played a significant role in reducing the number of 
high-risk chemical facilities that are susceptible to attack or exploitation. To date, more than 
3,000 facilities have eliminated, reduced or modified their holdings of chemicals of interest. The 
significant reduction in the number of chemical facilities that represent the highest risk is an 
important success of the CFATS program and is attributable both to the design of the program as 
enacted by Congress and to the work of CFATS personnel and industry at thousands of chemical 
facilities. 

The progress made in the CFATS program over the last two years has helped to put the program 
on a path to success; however, there is still work to be done. The Department continues to 
engage with stakeholders and focus on three core areas: reducing the backlog of site security 
plan approvals, improving the risk assessment process, and ensuring that all potentially high-risk 
facilities are identified and are meeting their existing regulatory obligations as required by the 
CFATS regulations.' Along with long-term authorization, our continued focus on these areas 
will ensure our stakeholders have the stability they need to comply with their regulatory 
obligations. We welcome the opportunity to work with you and our stakeholders on these 
important issues to further improve this vital national security program. 

CFATS Implementation Progress 

The cornerstone of the CFATS program is the development, submission, and implementation of 
Site Security Plans (SSPs), or Alternative Security Programs (ASPs) in lieu of SSPs, which 
document the security measures that high-risk chemical facilities utilize to satisfy the applicable 
Risk-Based Performance Standards (KBPS) under CFATS. It is important to note that these 
plans are not “one-size-fits-all,” but are in-depth, highly customized, and account for each 
facility’s unique circumstances. 

In order to determine whether a facility is regulated under CFATS, the facility submits a Top- 
Screen to the Department’s National Protection and Programs Directorate (NPPD) Infrastructure 
Security Compliance Division (ISCD) within the Office of Infrastructure Protection. Since we 
began collecting this information in 2007, ISCD has data from more than 46,000 Top-Screens 
submitted by chemical facilities, providing important information about their chemical holdings. 
Based on the information received in the Top-Screens, ISCD makes an initial determination that 
certain facilities are considered high-risk and assigns each of these to a preliminary tier^. These 
facilities then compile and submit Security Vulnerability Assessments (SVAs), which are used 
by ISCD to identify which facilities present a terrorism risk that is sufficiently high to warrant 
the assignment of a final high-risk tier under CFATS. As of April 21, 2014, CFATS covers over 
4,100 high-risk facilities nationwide; of these, over 3,250 have received final high-risk 


* A copy of the CFATS regulations can be found at httD://www.reeulations.gov/#!documentDetail:D=DHS-2006- 
0073-0115 . 


^ The Department has developed a risk-based tiering structure and assigns facilities to one of four risk-based tiers 
ranging from high {Tier 1) to low (Tier 4) risk. Assignment of preliminary and final tiers is based primarily on an 
assessment of the potential consequences of a successful attack on assets associated with chemicals of interest. 
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determinations and are required to develop SSPs (or ASPs) for ISCD review. The remaining 
facilities are awaiting final tier determinations based on their SVA submissions. The tiered 
population is dynamic and subject to change, depending on the chemical holdings and other 
conditions at facilities. 


Tier* 

Total # of 
Facilities 

Received 
Final Tier 

Authorized 
SSPs and 
ASPs 

Authorization 

Inspection 

Conducted 

Approved 
SSPs and 
ASPs 

Compliance 

Inspections 

Conducted 

1 

121 

111 

107 

106 

100 

20 

2 

382 

334 

262 

234 

213 

3 

3 

1088 

933 

590 

464 

317 

0 

4 

2542 

1914 

365 

130 

26 

0 

Total 

4133 

3292 

1324 

934 

657 

23 


*As of April 21, 2014 

** Totals do not include facilities that are no longer regulated, but have received letters of authorization, 
authorization inspections, and/or approved SSPs/ASPs 


Over the past year, the CFATS program has authorized, inspected, and approved hundreds of 
security plans. The program has also improved the pace of inspections and SSP approvals, 
developing new processes and distributing guidance materials. The majority of Tier 1 and Tier 2 
facilities (the highest of the high risk), as well as a number of Tier 3 and Tier 4 facilities, now 
have an approved security plan. In September 20 1 3, ISCD marked yet another milestone when 
we began conducting compliance inspections for facilities with approved SSPs, During 
compliance inspections, the Department verifies that the facility is implementing the measures 
contained in its approved SSP. The Department has developed a process whereby the timing for 
compliance inspections is based on a variety of factors, such as the facility’s risk tier, the facility 
and/or parent company’s past CFATS compliance history, date since last inspection, and the 
number of planned measures contained in the approved SSP. 

The improvements that have been made have accelerated the pace of approvals and we are 
continuing to identify and explore options to enhance the program. We recognize the projected 
timeframe for all approvals must be reduced and we are exploring a variety of ways to increase 
the pace at which approvals are granted while maintaining the quality and thoroughness of the 
security plan approval process and the level of security required at chemical facilities. These 
include encouraging increased use of ASPs and supporting stakeholders’ development of new 
ASP templates, focusing inspections on key KBPS at lower tier facilities, working with 
corporations to develop authorization inspection schedules that allow for multiple inspections by 
one inspection team per week, and inspecting measures at a corporate level for corporations that 
have similar measures implemented at multiple facilities. The Department continues to engage 
with CFATS stakeholders on efforts to expedite security plan reviews and is committed to 
identifying and implementing appropriate enhancements to streamline the CFATS process. 

ASPs are an important option for facilities that desire flexibility in their site security plan, and 
we appreciate the Subcommittee’s effort to ensure this option remains available for the CFATS 
program moving forward. 
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CFATS Risk Assessment 

As a part of our commitment to continue moving the CFATS program forward, NPPD has 
conducted a thorough review of our risk assessment process. In support of this review, NPPD 
implemented a phased approach, which included documenting all processes and procedures 
relating to the risk assessment methodology; conducting an internal NPPD review of the risk 
assessment process; and initiating an external peer review of the risk assessment methodology. 

All three of these phases are now complete, with the Department receiving the CFATS Tiering 
Methodology Peer Review Final Report from the expert peer review panel in October 2013. 
Although many of the peer review panel’s recommendations pertain to areas the Department had 
previously identified for improvement, we felt it was essential to engage external stakeholders 
through an external peer review to ensure the fullest expertise was engaged in risk assessment 
improvements. As a result of continued stakeholder engagement, the Report provides valuable 
perspectives that will inform our efforts to enhance the CFATS risk-tiering methodology. We 
have analyzed the peer review recommendations and developed an implementation plan to 
enable us to address the recommendations in a timely and thoughtful manner. We also recognize 
that it is essential to continue to engage our stakeholders in implementing changes to the risk 
assessment process. 

As recommended by the Peer Review Final Report, the Department intends to adopt appropriate 
changes to the tiering methodology in an integrated fashion, addressing as many issues 
concurrently as feasible. The implementation plan also addresses modifications to the tiering 
methodology stemming from efforts beyond the peer review, such as the economic and mission 
criticality studies being conducted on behalf of the Department by Sandia National Laboratories. 
Additionally, consistent with both recommendations within the Peer Review Final Report and 
our response to the Government Accountability Office’s report on the CFATS tiering 
methodology, ISCD intends to have a third-party verify and validate the revised tiering 
methodology. As we move forward with implementing recommendations, we are committed to 
ensuring these improvements are balanced with our stakeholders need for continued stability in 
tiering. 

Chemical Facility Safety and Security Improvement: A Shared Responsibility 

Since the inception of the CFATS program, the Department has worked to ensure that potentially 
regulated facilities are aware of their reporting obligation under the CFATS regulations and that 
they comply with these existing regulations. Following the explosion in West, Texas, in April 
2013, DFfS has taken a number of steps to reinvigorate this effort, including supporting the 
implementation of Executive Order (EO) 13650, Improving Chemical Facility Safety and 
Security. Under EO 13650, Federal agencies established a working group co-chaired by DHS, 
the Department of Labor, and the Environmental Protection Agency, with participation from the 
Department of Justice, Department of Transportation, and U.S. Department of Agriculture, to 
explore options for improving chemical facility safety and security to reduce the likelihood of 
incidents occurring in the future. The members of the Working Group have worked closely 
together over the past year to analyze and develop recommendations on improving information 
collection, more effectively sharing information between agencies, improving operational and 
federal coordination efforts, and improving the effectiveness of existing regulations and policies 
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governing chemicals and chemical facilities. These coordinated efforts will help ensure that the 
Federal government most effectively uses the collective resources available for managing 
chemical risk. 

Promoting Compliance 

The activities taking place in support of EO 1 3650 complement many of the individual efforts 
being undertaken within the Department, and other Federal departments and agencies, following 
the tragic events in West, Texas. Since the April 2013 explosion, DHS has engaged with 
numerous members of industry and all have agreed that we must work together to prevent future 
incidents. Industry has offered to share information about the CFATS regulatory requirements 
with other members of industry that may not currently be aware of CFATS and do their part to 
promote safety and security at chemical facilities. The Department appreciates this support and 
looks forward to working with industry and our government partners to carry out these activities. 
In pursuit of this shared responsibility, the Department has undertaken significant outreach 
efforts throughout the years, to inform potentially high-risk chemical facilities of their 
obligations under CFATS. These outreach efforts have been a major contributor to the 
submission of over 46,000 Top-Screens from potentially high-risk chemical facilities to date. 

As the tragic incident in West, Texas, demonstrated, not all facilities with threshold quantities of 
CFATS chemicals of interest have met their obligation to submit Top-Screens. DHS is 
committed to pursuing all reasonable measures to identify potential high-risk chemical facilities 
that are not among those that have already complied with initial Top-Screen submission 
requirements, and we will continue to work to get those facilities into compliance. When 
appropriate, the Department can utilize available enforcement mechanisms to bring non- 
compliant facilities into compliance. Both increased outreach and, where appropriate, the use of 
compliance enforcement mechanisms are part of the Department’s overall strategy to reduce the 
likelihood of potentially high-risk chemical facilities intentionally or unintentionally evading 
identification under the CFATS program. 

State and Local Partnerships 

The Department’s strategy for identifying potentially non-compliant facilities also includes 
enhanced coordination with Federal, State, and local partners. One such activity has focused on 
reinvigorating efforts with the EPA and other Federal partners with regulatory authority over the 
chemical industry to compare lists of regulated facilities to identify facilities which may have 
complied with another regulatory program and are potentially regulated under CFATS but have 
yet to comply with CFATS. Initial results from these efforts have been promising, with the 
Department seeing a substantial increase in the monthly rate of new Top-Screen submissions 
since August 2013. 

The Department is also undertaking similar efforts with States and localities. Since April 2013, 
ISCD has reached out to officials in all 50 States, including State Homeland Security Advisors 
(HSAs) and the Governors Homeland Security Advisory Council, about CFATS requirements. 
These efforts are in addition to continuing to provide State HSAs and their designees with access 
to information on CFATS-regulated facilities in their jurisdictions via CFATS Share, a Web- 
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based information-sharing portal that provides access to key information on CFATS facility 
information to certain Federal, State, and local agencies on an as needed basis. 

Outreach to Non-Compliant Facilities 

The Department is expanding outreach efforts to identify potentially non-compliant facilities and 
has developed an Outreach and Engagement Strategy and Implementation Plan to raise 
awareness of CFATS DHS will continue to operate its CFATS Tip Line and will follow up on 
any information of potentially non-compliant facilities. 

All of the aforementioned efforts are being undertaken in addition to the larger-scale efforts 
being coordinated under EO 13650. Of particular relevance is the effort being led by DHS under 
Section 5 of the EO, which addresses Enhanced Information Collection and Sharing. This 
section requires the development of recommendations on possible changes to improve and 
streamline information collection from regulated industries and recommendations to enhance 
data sharing between agencies, states, localities, and tribal entities to better identify facilities 
which may not have provided all required information or may be non-compliant with 
requirements. 

We feel strongly that our private sector stakeholders are key to our efforts to enhance data 
sharing, increase cross-training, and identify areas for possible regulatory changes as well as 
identifying possible gaps in existing statutory authorities. Enhancing security and building 
resilience across the chemical sector is not something a single company, industry or even 
government can do by itself. This has to be a collaborative effort. It also has to be a 
comprehensive effort, because of the sheer complexity of affected facilities, the linkages to other 
sectors, and the potential cascading effects and consequences of a significant attack or 
disruption. 

Industry Engagement 

Industry engagement has always been an important aspect of CFATS, but will be more important 
than ever as we move forward with program improvements. Chemical Security Inspectors play 
an important role, serving as our boots on the ground and the face of CFATS in the field. 
Inspectors and interagency partners from the Federal Bureau of Investigation provide assistance 
and outreach directly to facilities and play an important role in helping facilities identify 
appropriate security measures. For example, one facility had numerous positive aspects to their 
security program, but failed to address any security measures for small containers, which could 
easily be concealed within a handbag or backpack. Through the inspection, the facility 
understood the potential vulnerability and developed planned measures to prohibit bags within 
the restricted area and to inspect hand-carried items when exiting the restricted area to ensure 
nothing sensitive is being removed. Another example is a different regulated facility that had 
effective security for the chemicals of interest located within the building, but failed to address 
the chemicals of interest located in the open storage yard. As a result of the inspection, the 
facility identified a new restricted area to store the chemicals of interest within the main building 
and added procedures to ensure that upon receipt, the appropriate facility personnel immediately 
moved the chemicals of interest into the new restricted area. In addition to conducting 
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inspections and providing compliance assistance to facilities, NPPD’s chemical inspectors 
actively work with local stakeholders and governmental agencies across the country. 

The Need for Program Authorization 

DHS recognizes the significant work that the Committee and others have undertaken to 
reauthorize the CFATS program. The progress we have made over the last two years 
demonstrates the Department’s commitment to ensuring this program is a success. 

However, the federal funding hiatus last October illustrates the complications in the current 
authorization structure. The funding hiatus directly impacted the CFATS program because the 
program is authorized through annual appropriations bills. The hiatus resulted in all ISCD staff 
being furloughed, which resulted in cancellation of numerous inspections and immobilized 
security plan approvals. In addition to the shutdown of programmatic activities, the 
authorization of the CFATS program expired on October 5, 2013. The gap in program 
authorization caused concern among regulated facilities, with many facilities questioning 
whether the regulations were still in effect. This confusion and uncertainty demonstrated the 
need for long-term authorization outside of the appropriations process. Moreover, it is unclear if 
the Department would have had the authority to act had there been an exigent need during the 
shutdown to take enforcement action under CFATS in furtherance of national security interests. 
Long-term authorization would address this as well. 

The Department strongly believes that an authorization would be beneficial to your oversight 
activities by ensuring the full maturation of the program and the review and approval of all 
backlogged Site Security Plans. Perhaps most importantly, long term authorization will provide 
industry stakeholders with the stability needed to plan for and invest in CFATS-related security 
measures to harden their critical sites against terrorist attack or exploitation. Companies have 
regularly communicated to us that their capital-planning/budgeting processes for security 
improvements frequently run on a three-to-five-year cycle and they deserve to know that the 
program will not be allowed to lapse as they invest in major CFATS-related security 
improvements. 

Uncertainty about the future of CFATS also has provided an incentive for potentially regulated 
facilities storing large quantities of dangerous chemicals to ignore their obligations under 
CFATS in hopes that the program will be allowed to sunset. An authorization period of five 
years or longer would enable Congress to send an important message to such facilities that may 
willfully be seeking to avoid compliance. 

In addition, the committee’s efforts to codify and enhance the Department’s authority to seek out 
non-compliant facilities will greatly support our ongoing actions to bring such facilities into 
compliance. In the year following the explosion at the West Fertilizer plant in Texas, the 
Department has been committed to ensuring that facilities across the Nation are both aware of 
the requirements to report under CFATS and meet their obligations. The Department has 
worked closely with our interagency partners to implement EO 13650; equally important is 
providing specific statutory authority for engaging these non-compliant facilities. Finally, the 
Department believes Congress should take action to address the gap in the framework for 
regulating the security of chemicals at water and wastewater treatment facilities in the 
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United States, and believes the options provided in the recent Information Collection Request for 
facility compliance with RBPS-12, personnel surety, are the most appropriate for identifying 
personnel with terrorist ties that may have access to the high-risk chemicals at a facility. 

Conclusion 

The Department has made significant improvements to the CFATS program and is moving 
forward strategically to address the challenges that remain. The Department has taken important 
steps to build a strong CFATS program and has a seasoned leadership team committed to the 
success of the program. With your support, we can ensure our Nation is more secure by 
continuing implementation of the CFATS program, and we are committed to working with you 
to pass legislation to authorize the program. With support from industry and action by Congress 
to authorize the program, the CFATS program’s mission to protect Americans will be 
strengthened. 

As we implement CFATS, we will continue to work with stakeholders to keep our Nation secure 
by preventing terrorists from exploiting chemicals or chemical facilities. We firmly believe that 
CFATS is making the Nation more secure by reducing the risks associated with our Nation’s 
chemical infrastructure and we are — along with our stakeholders and partners — committed to its 
continued success. 
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CRITICAL INFRASTRUCTURE PROTECTION 

Observations on DHS Efforts to Implement and 
Manage its Chemical Security Program 


What GAO Found 

In managing ite Chemical Facility Anti-Terrorism Standards (CFATS) program, 
the Department of Homeland Security (DHS) has a number of efforts underway 
to identify faciiiti^ that are covered by the program, assess risk and prioritize 
facilities, review and approve facility security plans, and inspect facilities to 
ensure compliance with security regulations. 

• Identifying facilities. DHS has begun to work with other agencies to identify 
facilities that should have reported their chemical holdings to CFATS, but 
may not have done so. DHS initially identified about 40,000 facilities by 
publishing a CFATS rule requiring that facilities with certain types and 
quantities of chemicals report certain information to DHS. However, a 
chemical explosion in West, Texas last year demonstrated the risk posed by 
chemicals covered by CFATS. Subsequent to this incident, the President 
issued Executive Order 13650 which was intended to improve chemical 
facility safety and security in coordination with owners and operators. Under 
the executive order, a federal working group is sharing information to identify 
additional facilities that are to be regulated under CFATS, among other 
things. 

• Assessing risk and prioritizing facilities. DHS has begun to enhance its 
ability to assess risks and prioritize facilities. DHS assessed the risks of 
facilities that reported their chemical holdings in order to determine which 
ones would be required to participate in the program and subsequently 
develop site security plans. GAO’s April 2013 report found weaknesses in 
multiple aspects of the risk assessment and prioritization approach and made 
recommendations to review and improve this process. In February 2014, 

DHS officials told us they had begun to take action to revise the process for 
assessing risk and prioritizing facilities. 

• Reviewing security plans. DHS has also begun to take action to speed up 
its reviews of facility security plans. Per the CFATS regulation, DHS is to 
review security plans and visit the facilities to make sure their security 
measures meet the risk-based performance standards. GAO's April 2013 
report found a 7- to 9-year backlog for these reviews and visits, and DHS has 
begun to take action to expedite these activities. As a separate matter, one of 
the performance standards — personnel surety, under which facilities are to 
perform background checks and ensure appropriate credentials for personnel 
and visitors as appropriate— -is being developed. Of the facility plans DHS 
had reviewed as of February 2014, it conditionally approved these plans 
pending final development of the personal surety performance standard. 
According to DHS officials, it is unclear when the standard will be finalized, 

• Inspecting to verify compliance. In February 201 4, DHS reported it had 
begun to perform inspections at facilities to ensure compliance with their site 
security plans. According to DHS, these inspections are to occur about 1 
year after facility site security plan approval. Given the backlog in plan 
approvals, this process has started recently and GAO has not yet reviewed 
this aspect of the program. 

United States Government Accountability Office 


57 


Chairman Carper, Ranking Member Coburn, and Members of the 
Committee; 

I am pleased to be here today to discuss our work on the Department of 
Homeland Security’s (DHS) efforts in implementing and managing the 
Chemical Facility Anti-Terrorism Standards (CFATS) program. Facilities 
that produce, store, or use hazardous chemicals could be of interest to 
terrorists intent on using toxic chemicals to cause harm to surrounding 
populations during terrorist attacks, and these chemicals could be stolen 
and used as chemical weapons, such as Improvised explosive devices, or 
as the ingredients for making chemical weapons. The danger posed by 
these chemicals became evident last year when ammonium nitrate — one 
of the chemicals covered by the CFATS program — detonated during a fire 
at a fertilizer storage and distribution facility in West, Texas. An 
investigation by the U.S. Chemical Safety Board (CSB) showed that the 
explosion killed at least 14 people and injured more than 200 others and 
severely damaged or destroyed nearly 200 homes, 3 nearby schools, a 
nursing home, and an apartment complex.^ According to CSB, the fire at 
the facility detonated about 30 tons of ammonium nitrate. This event 
serves as a tragic reminder of the extent to which chemicals covered by 
the CFATS program can pose a risk to surrounding populations, 

The DHS appropriations act for fiscal year 2007^ required DHS to issue 
regulations to establish risk-based performance standards for securing 
high-risk chemical facilities.^ In 2007, DHS established the CFATS 
program to assess the risk posed by chemical facilities, place facilities 
considered to be high-risk in one of four risk-based tiers, require high-risk 


^Rafael Moure-Eraso, Chairperson, U S. Chernicai Safety Board, testimony before the 
Senate Committee on Environment and Public Works, Congress 1st Sess., June 
27. 2013. The CSB is an independent federal agency charged with investigating industrial 
chemical accidents. The CSB board members are appointed by the President and 
confirmed by the Senate. According to the CSB website, CSB does not issue fines or 
citations, but makes recommendations to plants, regulatory agencies, industry 
organizations, and labor groups. 

2pub. L. No. 109-295, § 550, 120 Stat, 1355, 1388 (2006). 

^The CFATS regulation establishes 18 risk-based performance standards that identify the 
areas forwrhich a facility's security are to be examined, such as perimeter security, access 
conti-ol, and cyber security. To meet these standards, facilities are free to dioose 
whatever security programs or processes they deem appropriate so long as DHS 
determines ttiat ^e facilities achieve the requisite level of performance in each applicable 
stendard. 
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facilities to develop security plans, review these plans, and inspect the 
facilities to ensure compliance with regulatory requirements. DHS’s 
National Protection and Programs Directorate (NPPD) is responsible for 
the CFATS program. VNfithin NPPD, the Infrastructure Security 
Compliance Division (ISCD), a division of the Office of infrastructure 
Protection (IP), manages the program. 

On February 6, 2014 congressman Meehan and other members of the 
House of Representatives' Committee on Homeland Security, along with 
one member of the House of Representatives’ Committee on Energy and 
Commerce, introduced H.R. 4007, the Chemical Facility Anti-Terrorism 
Standards Authorization and Accountability Act of 2014,'* Among other 
things, H.R. 4007 contained provisions regarding multiple aspects of the 
CFATS program, including risk assessment, security plan reviews, and 
facility Inspections. On April 30, 2014, the bill, as amended, was reported 
out by the House Committee on Homeland Security. Related to H.R. 

4007, on February 27, 2014, we testified on DHS efforts to implement and 
manage the CFATS program at a legislative hearing before the 
Subcommittee on Cybersecurity, infrastructure Protection, and Security 
Technologies, House Committee on Homeland Security.® 

The purpose of this statement is to provide our observations on the status 
of DHS’s efforts related to the implementation and management of the 
CFATS program. Specifically my testimony today summarizes our past 
work on the CFATS program and provides our observations on the status 
of DHS's efforts in four key areas— identifying facilities to be covered by 
CFATS. assessing risk and prioritizing covered facilities, reviewing facility 
security plans, and inspecting facilities to verify compliance with CFATS 
regulations. My statement is based on reports and a testimony we issued 
from July 2012 through February 2014 on various aspects of the CFATS 


"H.R, 4007, 113th Cong. (2014). 

®GAO. Critical Infrastructure Protection: Observations on DHS Efforts to Identify, Prioritize, 
Assess, and Inspect Chemical Facilities, GAO-14-365T (Washington, D.C,: February 27, 
2014). 
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program.® To conduct our prior work, we reviewed applicable laws and 
regulations, as well as NPPD, IP, and ISCD policies and procedures for 
administering the CFATS program and conducting its mission. We 
interviewed senior ISCD officials along with NPPD and IP officials to 
obtain their views on the program and how ISCD assesses risk. We also 
reviewed ISCD documents and data on tiered facilities and the approach 
used to determine a facility’s risk and assessed ISCD’s process for 
reviewing security plans. Further details on the scope and methodology 
for the previously issued reports and testimony statement are available 
within each of the published products. 

We conducted the work on which this statement is based in accordance 
with generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and conclusions 
based on our audit objectives. We believe the evidence obtained provides 
a reasonable basis for our findings and conclusions based on our audit 
objectives. 


Observations on 
DHS Efforts to 
Identify Facilities, 
Assess Risk, Review 
Security Plans, and 
Verify Compliance 


Identifying Facilities DHS has begun to take action to work with other agencies to identify 

Covered by CFATS facilities that are required to report their chemical holdings to DHS but 

may not have done so. 


®GAO-14-365T. Critical Infrastructure Protection: DHS Needs to Improve Its Risk 
Assessments and Outreach for Chemical Facilities, GAO-1 3-801T (Washington, D C.: 
Aug. 1, 2013); Critical Infrastructure Protection: DHS Efkirts to Assess Chemical Security 
Risk and Gather Feedback on Facility Outreach Can Be Strengthened, GAO-13'353 
(Washington, D C.; Apr. 5. 2013); Critical Infrastructure Protection: DHS Is Taking Action 
to Better Manage Its Chemical Security Program, but It Is Too Early to Assess Results, 
GAO-12-515T (Washington. D.C.: July 26. 2012). 
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The first step of the CFATS process is focused on identifying facilities that 
might be required to participate in the program. The CFATS rule was 
published In April 2007/ and appendix A to the rule, published in 
November 2007, fisted 322 chemicals of interest and the screening 
threshold quantities for each.® As a result of the CFATS rule, about 
40,000 chemical facilities reported their chemical holdings and their 
quantities to DHS’s ISCD. 

In August 2013, we testified about the ammonium nitrate explosion at the 
chemical facility in West. Texas, in the context of our past CFATS work. 
Among other things, the hearing focused on whether the West, Texas, 
facility should have reported its holdings to ISCD given the amount of 
ammonium nitrate at the facility. During this hearing, the Director of the 
CFATS program remarked that throughout the existence of CFATS, DHS 
had undertaken and continued to support outreach and industry 
engagement to ensure that facilities comply with their reporting 
requirements. However, the Director stated that the CFATS regulated 
community is large and always changing and DHS relies on facilities to 
meet their reporting obligations under CFATS. At the same hearing, a 
representative of the American Chemistry Council testified that the West, 
Texas, facility could be considered an “outlier" chemical facility, that is, a 
facility that stores or distributes chemical-related products, but Is not part 
of the established chemical Industry. Preliminary findings of the CSB 
investigation of the West, Texas, incident showed that although certain 
federal agencies that regulate chemical facilities may have interacted with 
the facility, the ammonium nitrate at the West, Texas, facility was not 
covered by these programs. For example, according to the findings, the 
Environmental Protection Agency’s (EPA) Risk Management Program, 
which deals with the accidental release of hazardous substances, covers 
the accidental release of ammonia, but not ammonium nitrate.® As a 
result, the facility's consequence analysis considered only the possibility 
of an ammonia leak and not an explosion of ammonium nitrate. 


^72 Fed. Reg. 17,688 {Apr. 9, 2007) {codified at 6 C.F.R, pt. 27). 

®72 Fed. Reg. 65,396 {Nov. 20, 2007). According to DHS, CFATS covers feciiities that 
manufacture diemicais as well as facilities that store or use certain chemicals as part of 
their daily operations. This can indude food-manufacturing facilities that use chemicais of 
interest in the manufecturing process, universities that use diemicals to do experiments, 
or warehouses that store ammonium nitrate, among others. 

“See 40 C.F.R. §68.130. 
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On August 1, 2013, the same day as the hearing, the President issued 
Executive Order 13650-/rnprov/ng Chemical Facility Safety and Security, 
which was intended to improve chemical facility safety and security in 
coordination with owners and operators.’® The executive order 
established a Chemical Facility Safety and Security Working Group, 
composed of representatives from DHS; EPA; and the Departments of 
Justice, Agriculture, Labor, and Transportation, and directed the working 
group to identify ways to improve coordination with state and local 
partners; enhance federal agency coordination and information sharing; 
modernize policies, regulations and standards; and work with 
stakeholders to identify best practices. In February 2014, DHS officials 
told us that the working group has taken actions in the areas described in 
the executive order. For example, according to DHS officials, the working 
group has held listening sessions and webinars to increase stakeholder 
input, explored ways to share CFATS data with state and local partners to 
increase coordination, and launched a pilot program in New York and 
New Jersey aimed at increasing federal coordination and information 
sharing. DHS officials also said that the working group is exploring ways 
to better share information so that federal and state agencies can identify 
non-compliant chemical facilities and identify options to improve chemical 
facility risk management. This would include considering options to 
improve the safe and secure storage, handling, and sale of ammonium 
nitrate. 


Assessing Risk and DMS has also begun to take actions to enhance its ability to assess risk 

Prioritizing Faciiities ^hd prioritize facilities covered by the program. 

For the second step of the CFATS process, facilities that possess any of 
the 322 chemicals of interest at levels at or above the screening threshold 
quantity must first submit data to ISCD via an online tool called a Top- 
Screen." ISCD uses the data submitted in facilities’ Top Screens to make 
an assessment as to whether facilities are covered under the program. If 
DHS determines that they are covered by CFATS, facilities are to then 
submit data via another online tool, called a security vulnerability 
assessment, so that ISCD can further assess their risk and prioritize the 


’“Exec. Order No, 13,650, 78 Fed. Reg. 48,029 (Aug. 1, 2013). 
"eC.F.R. §27,200(b)(2). 
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covered facilities.^^ ISCD uses a risk assessment approach to develop 
risk scores to assign chemical facilities to one of four final tiers. Facilities 
placed in one of these tiers (tier 1,2,3, or 4) are considered to be high 
risk, with tier 1 facilities considered to be the highest risk.^^ The risk score 
is intended to be derived from estimates of consequence (the adverse 
effects of a successful attack), threat (the likelihood of an attack), and 
vulnerability (the likelihood of a successful attack, given an attempt). 
ISCD's risk assessment approach is composed of three models, each 
based on a particular security issue: (1) release, (2) theft or diversion, and 
(3) sabotage, depending on the type of risk associated with the 322 
chemicals. Once ISCD estimates a risk score based on these models, it 
assigns the facility to a final tier. 

Our prior work showed that the CFATS program was using an incomplete 
risk assessment approach to assign chemical facilities to a final tier. 
Specifically, in April 2013, we reported that the approach ISCD used to 
assess risk and make decisions to place facilities in final tiers did not 
consider all of the elements of consequence, threat, and vulnerability 
associated with a terrorist attack involving certain chemicals. For 
example, the risk assessment approach was based primarily on 
consequences arising from human casualties, but did not consider 
economic criticality consequences, as called for by the 2009 National 
Infrastructure Protection Plan (NIPP)’^ and the CFATS regulation.^® In 
April 2013, we reported that ISCD officials told us that, at the inception of 
the CFATS program, they did not have the capability to collect or process 


^^eC.F R. §§ 27.215, .220. 

’^6 C.F.R. § 27.220 

^*DHS, National Infrastn/cture Protection Plan {Washington, D.C,: June 2006). The NIPP 
sets forth the risk management framework for the protection and resilience of the nation's 
critical infrastructure. DHS updated the NIPP in January 2009 to include resiliency. See 
OHS, National Infrastructure Protection Plan, Partnering to Enhance Protec^on and 
Resiliency (Washington. O.C.; January 2009), Broadly defined, risk management is a 
process that helps policymakers assess risk,, strategically allocate finite resources, and 
take actions under conditions of uncertainty. DHS fijrther updated the NIPP. which is now 
called the National Plan, in December 2013, See DHS. NIPP 201 3, Partnering for Critical 
Infrastructure Security and Resilience (Washington, D.C.: December 201 3), 

''®The CFATS regulation states friat chemical facilities covered by the rule are those that 
present a high risk of significant adverse consequences for human life or health or critical 
economic assets, among other things, if subjected to terrorist attack, compromise, 
infiltration, or exploitation. 6 C.F.R. §§ 27.105, .205. 
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all of the economic data needed to calculate the associated risks and they 
were not positioned to gather all of the data needed. They said that they 
collected basic economic data as part of the initial screening process; 
however, they would need to modify the current tool to collect more 
sufficient data. We also found that the risk assessment approach did not 
consider threat for approximately 90 percent of tiered facilities. Moreover, 
for the facilities that were tiered using threat considerations, ISCD was 
using 5-year-o1d data. We also found that ISCD's risk assessment 
approach was not consistent with the NIPP because it did not consider 
vulnerability when developing risk scores. When assessing facility risk, 
ISCD’s risk assessment approach treated every facility as equally 
vulnerable to a terrorist attack regardless of location and on-site security. 
As a result, in April 2013 we recommended that ISCD enhance its risk 
assessment approach to Incorporate ail elements of risk and conduct a 
peer review after doing so. 

ISCD agreed with our recommendations, and in February 2014, ISCD 
officials told us that they were taking steps to address them and 
recommendations of a recently released Homeland Security Studies and 
Analysis Institute (HSSAI) report that examined the CFATS risk 
assessment model.’® As with the findings in our report, HSSAI found, 
among other things, that the CFATS risk assessment model 
inconsistently considers risks across different scenarios and that the 
model does not adequately treat facility vulnerability. Overall, HSSAI 
recommended that ISCD revise the current risk-tiering model and create 
a standing advisory committee— with membership drawn from 
government, expert communities, and stakeholder groups— to advise 
DHS on significant changes to the methodology. 

In February 2014, senior ISCD officials told us that they have developed 
an Implementation plan that outlines how they plan to modify the risk 
assessment approach to better include all elements of risk while 
incorporating our findings and recommendations and those of HSSAI. 
Moreover, these officials stated that they have completed significant work 
with Sandia National Laboratory with the goal of including economic 


’^Homeland Security Studies and Analysis Institute, CFATS Tiering Methodology Peer 
Review (For Official Use Only) (Falls Church, Virginia; October 2013). The Homeland 
Security Studies and Analysis Institute, operated by Analytic Services Inc. on behalf of 
DHS. is a federally tended research and development center providing independent 
analyses of homeland security issues. 
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consequences into their risk tiering approach. They said that the final 
results of this effort to include economic consequences will be available in 
the summer of 2014. With regard to threat and vulnerability, ISCD officials 
said that they have been working with multiple DHS components and 
agencies, including the Transportation Security Administration and the 
Coast Guard, to see how they consider threat and vulnerability in their 
risk assessment models. ISCD officials said that they anticipate that the 
changes to the risk tiering approach should be completed within the next 
12 to 18 months. We plan to verify this information as part of our 
recommendation follow-up process. 


Reviewing of Facilities’ DHS has begun to take action to lessen the time it takes to review site 
Security Plans security plans which could help DHS reduce the backlog of plans awaiting 

review. 

For the third step of the CFATS process, ISCD is to review facility security 
plans and their procedures for securing these facilities. Under the CFATS 
rule, once a facility is assigned a final tier, it is to submit a site security 
plan or participate in an alternative security program in lieu of a site 
security plan.” The security plan is to describe security measures to be 
taken and how such measures are to address applicable risk-based 
performance standards.” After ISCD receives the site security plan, the 
plan is reviewed using teams of ISCD employees (I.e., physical, cyber, 
chemical, and policy specialists), contractors, and ISCD inspectors. If 
ISCD finds that the requirements are satisfied, ISCD issues a letter of 
authorization to the facility. After ISCD issues a letter of authorization to 
the facility, ISCD is to then inspect the facility to determine if the security 
measures implemented at the site comply with the facility's authorized 
plan. If ISCD determines that the site securi^ plan is in compliance with 
the CFATS regulation, ISCD approves the site security plan, and issues a 
letter of approval to the facility, and the facility is to implement the 
approved site security plan. 


”An alternative security program is a third-party or industry organization program, a local 
authority, state, or federal government program, or any element or aspect thereof, that 
DHS detemiines meets the requirements of the regulation and provides an equivalent 
level of security to that established by the regulation. 6 C.F.R. § 27.105. 

”6 C.F.R, § 27.226. 
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In April 2013, we reported that it could take another 7 to 9 years before 
ISCD would be able to complete reviews of the approximately 3,120 plans 
in its queue at that time. As a result, we estimated that the CFATS 
regulatory regime, including compliance inspections (discussed in the 
next section), would likely not be implemented for 8 to 10 years. We also 
noted in April 2013 that ISCD had revised its process for reviewing 
facilities’ site security plans. ISCD officials stated that they viewed iSCD’s 
revised process to be an improvement because, among other things, 
teams of experts reviewed parts of the plans simultaneously rather than 
sequentially, as had occurred in the past. In April 2013, ISCD officials 
said that they were exploring ways to expedite the process, such as 
streamlining Inspection requirements. 

In February 2014. ISCD officials told us that they are taking a number of 
actions intended to lessen the time it takes to complete reviews of 
remaining plans including the following: 

• providing updated internal guidance to inspectors and ISCD 
reviewers; 

• updating the internal case management system; 

• providing updated external guidance to facilities to help them better 
prepare their site security plans; 

• conducting inspections using one or two inspectors at a time over the 
course of 1 day, rather than multiple inspectors over the course of 
several days; 

• conducting pre-inspection calls to the facility to help resolve technical 
issues beforehand; 

• creating and leveraging the use of corporate inspection documents 
(i.e., documents for companies that have over seven regulated 
facilities in the CFATS program);’® 

• supporting the use of alternative security programs to help clear the 
backlog of security plans because, according to DHS officials, 
alternative security plans are easier for some facilities to prepare and 
use; and 


’®According to ISCD officials, these documents would be designed to provide examples of 
standard operating procedures regarding employee vetting, chemical handling, or security 
practices that are standard across corporations and that could be placed in a facility's file 
and expedite the inspection process. 
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• taking steps to streamline and revise some of the on-line data 
collection tools such as the site security plan to make the process 
faster. 

It is too soon to tell whether DHS’s actions will significantly reduce the 
amount of fime needed to resolve the backlog of site security plans 
because these actions have not yet been fully implemented. 

In April 2013, we also reported that DHS had not finalized the personnel 
surety aspect of the CFATS program. The CFATS rule includes a risk- 
based performance standard for personnel surety, which is intended to 
provide assurance that facility employees and other individuals with 
access to the facility are properly vetted and cleared for access to the 
facility. In Implementing this provision, we reported that DHS intended to 
(1) require facilities to perform background checks on and ensure 
appropriate credentials for facility personnel and, as appropriate, visitors 
with unescorted access to restricted areas or critical assets, and (2) 
check for terrorist ties by comparing certain employee information with the 
federal government’s consolidated terrorist watch list. However, as of 
February 2014, DHS had not finalized its information collection request 
that defines how the personnel surety aspect of the performance 
standards wilt be implemented. Thus, DHS is currently approving facility 
security plans conditionally whereby plans are not to be finally approved 
until the personnel surety aspect of the program Is finalized. According to 
ISCD officials, once the personnel surety performance standard is 
finalized, they plan to reexamine each conditionally approved plan. They 
would then make final approval as long as ISCD had assurance that the 
facility was in compliance with the personnel surety performance 
standard. As an interim step, in February 2014, DHS published a notice 
about its Information Collection Request (ICR) for personnel surety to 
gather information and comments prior to submitting the ICR to the Office 
of Management and Budget (0MB) for review and clearance.^^ According 
to ISCD officials, It is unclear when the personnel surety aspect of the 
CFATS program will be finalized. 


C.F,R.§27.230(3)(12). 

^^9 Fed, Reg. 6418 {Feb. 3. 2014). DHS previously published a notice about the 
pereonnei surety ICR on March 22. 2013. 78 Fed. Reg, 17,680 (Mardi 22, 2013). 
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During a March 2013 hearing on the CFATS program, industry officials 
discussed using DHS’s Transportation Worker Identification Credential 
(TWIG) as one approach for Implementing the personnel surety program. 
The TWiC, which is also discussed In DHS’s ICR, is a biometric 
credentials^ issued by DHS for maritime workers who require unescorted 
access to secure areas of facilities and vessels regulated under the 
Maritime Transportation Security Act of 2002 (MTSA).^^ In discussing 
TWIC in the context of CFATS during the August 2013 hearing, officials 
representing some segments of the chemical industry stated that they 
believe that using TWIC would lessen the reporting burden and prevent 
facilities from having to submit additional personnel information to DHS 
while maintaining the integrity of the program. In May 2011, and May 
2013, we reported that the TWIC program has some shortfalls— including 
challenges in development, testing, and implementation — that may limit 
its usefulness with regard to the CFATS program.^^ We recommended 
that DHS take steps to resolve these issues, including completing a 
security assessment that includes addressing internal controls 
weaknesses, among other things. The explanatory statement 
accompanying the Consolidated Appropriations Act, 2014, directed DHS 
to complete the recommended security assessment. However, as of 
February 2014, DHS had not yet done the assessment, and although 


biometric access control system consists of technology that determines an individual's 
identity by detecting and matching unique physical or behavioral characteristics, such as 
fingerprint or voice patterns, as a means of verifying personal identity. 

^^See Pub. L. No. 107-295,116 Stat. 2064. The TWIC program is intended to provide a 
tamper-resistant biometric credential to maritime workers who require unescorted access 
to secure areas of facilities and vessels regulated under the MTSA. TWIC is to enhance 
the ability of MTSA-regulated facility and vessel owners and operators to control access to 
their facilities and verify workers’ identities. Under current statute and regulation, maritime 
workers requiring unescorted access to secure areas of MTSA-regulated facilities or 
vessels are required to obtain a TWIC, and facility and vessel operators are required by 
regulation to visually inspect each worker’s TWiC before granting unescorted access. 46 
U.S.C. § 70105(a); 33C.F.R. §§ 101.514, 104.265(c), 105-255(c). Prior to being granted a 
TWIC, maritime workers are required to undergo a background check, known as a 
security threat assessment. See 49 C.F R § 1572.21. 

^‘^GAO, Transportation Worker Identification Credential: Card Reader Pilot Results Are 
Unreliable: Security Benefits Need to Be Reassessed, GAO-13-198 (Washington, D.C.: 
May 8. 2013); Transportation Worker Identification Credential: Internal Control 
Weaknesses Need to Be Corrected to Help Achieve Security Objectives, GAO-1 1-657 
(Washington. D.C,: May 10. 2011). 

^^Explanatory statement accompanying the Consolidated Appropriations Act. 2014, Pub, 

L No. 113-76, 128 Stat. 6(2014). 
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DHS had taken some steps to conduct an internal control review, it had 
not corrected all the control deficiencies identified in our report. 


Inspecting to Verify 
Compliance with 
Facility Plans 


DHS reports that it has begun to perform compliance inspections at 
regulated facilities. The fourth step in the CFATS process is compliance 
inspections by which ISCD determines if facilities are employing the 
measures described in their site security plans. During the August 1 , 

2013, hearing on the West, Texas, explosion, the Director of the CFATS 
program stated that ISCD planned to begin conducting compliance 
inspections in September 2013 for facilities with approved site security 
plans. The Director further noted that the inspections would generally be 
conducted approximately 1 year after plan approval. According to ISCD, 
as of February 24, 2014, ISCD had conducted 12 compliance inspections. 
ISCD officials stated that they have considered using third-party non- 
governmental inspectors to conduct inspections but thus far do not have 
any plans to do so. 


In closing, we anticipate providing oversight over the issues outlined 
above and look fonward to helping this and other committees of Congress 
continue to oversee the CFATS program and DHS’s progress in 
implementing this program. Currently, the explanatory statement 
accompanying the Consolidated and Further Continuing Appropriations 
Act, 2013, directs GAO to continue its ongoing effort to examine the 
extent to which DHS has made progress and encountered challenges in 
developing CFATS. Additionally, once the CFATS program begins 
performing and completing a sufficient number of compliance inspections, 
we are mandated review those inspections aiong with various aspects of 
them.“ 

Chairman Carper, Ranking Member Coburn, and members of the 
Committee, this completes my prepared statement. I would be happy to 
respond to any questions you may have at this time. 


^^Explanatory statement accompanying the Consolidated and Further Continuing 
Appropriations Act, 2013. Pub. L. No. 113-6, 127 Stat. 198 (2013). 
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May 14, 2014 

“Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards Program” 

Thank you for the opportunity to testify before the committee today. My name is Dana Shea, and I am a 
Specialist in Science and Technology Policy at the Congressional Research Service. At the Committee’s 
request, I am here to discuss federal efforts to secure chemical facilities within the United States from 
terrorist attack. In addition to my remarks today, CRS has several reports on this topic,* and in accordance 
with our enabling statutes, CRS takes no position on any related legislation 

My testimony today has three parts. Finst, I will provide a brief overview of the efforts by the Department 
of Homeland Security (DHS) to increase security at chemical facilities through the Chemical Facility 
Anti-Terrorism Standards (CFATS) regulatory program. In this context, I will discuss some of the 
program’s progress and challenges and how it has responded to audits and oversight reports issued by the 
Department’s Inspector General and the Government Accountability Office (GAO). Second, I will 
identify several policy issues that may be of interest to the Committee and Congress regarding 
authorization of the CFATS program. These issues will include efforts to improve risk assessment within 
the CFATS program; efforts to use third parties to inspect regulated facilities, and efforts to better 
leverage chemical process expertise and best practices to mitigate risk. Third, I will provide a brief 
analysis of H.R. 4007, the Chemical Facility Anti-Terrorism Standards Program Authorization and 
Accountability Act of 2014, as amended and ordered reported by the House Committee on Homeland 
Security. 


Program Overview 

State and federal governments have long recognized the potential harm that a large, sudden release of 
hazardous chemicals poses to nearby people. In response, they have regulated safety practices at chemical 
facilities. Chemical facilities historically engaged in security activities — as distinct from safety — on a 
voluntary basis. After the 2001 terrorist attacks and the decision by several states to begin regulating 


‘ See CRS Report R42918. Chemical Faciliiy Security: Issues and Options for the 1 13th Congress, by Dana A. Shea; CRS 
Report R43346, Implementation of Chemical Facility Anti-Terrorism Standards (CFATS): Issues for Congress, by Dana A. Shea; 
and CRS Report R43070, Regulation of Fertilizers: Ammonium Nitrate and Anhydrous Ammonia, by Dana A. Shea, David M. 
Bearden, and Scott D. Szymendera. 
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security at chemical facilities, Congress addressed whether to establish federal security requirements to 
mitigate these risks. 


Statute and Regulation 

In 2006, the 109“’ Congress passed legislation providing the Department of Homeland Security (DHS) 
with statutory authority to regulate chemical facilities for security purposes. This authority came through 
a provision in an appropriations The statute contains a “sunset provision” with an expiration date for 
the statutory authority. Subsequent Congresses have extended this authority, which currently expires on 
October 4, 2014.^ Advocacy groups, stakeholders, and policy makers have called for Congress to 
reauthorize this authority, though they disagree about the preferred approach. 

The 2006 statute required DHS to issue regulations within 6 months of enactment. On April 9, 2007, DHS 
issued an interim final rule regarding the chemical facility anti-terrorism standards (CFATS).'^ In 
promulgating the interim final rule, DHS interpreted the language of the statute to determine what DHS 
asserts was the intent of Congress. Consequently, much of the rule arises from the Secretary’s discretion 
and interpretation of legislative intent rather than from explicit statutory language. 

Under the interim final rule, the Secretary of Homeland Security determines which chemical facilities 
must meet regulatory security requirements, based on the degree of risk posed by each facility. The DHS 
lists 322 “chemicals of interest” for the purpose of compliance with CFATS. The DHS considers each 
chemical in the context of three threats: release; theft or diversion; and sabotage and contamination. 
Chemical facilities with greater than specified quantities, called screening threshold quantities, of 
chemicals of interest must submit information to DHS to determine the facility’s risk status. As a 
consequence of this approach, the CFATS regulation applies to numerous facilities not traditionally 
considered to be part of the chemical manufacture or distribution sector. The statute exempts several types 
of facilities: facilities defined as a water .system or wastewater treatment works; facilities owned or 
operated by the Department of Defense or Department of Energy; facilities regulated by the Nuclear 
Regulatory Commission (NRC); and facilities regulated under the Maritime Transportation Security Act 
of 2002 (P.L. 107-295). 

Also under the interim final rule, DHS developed a tiered regulatory framework. Facilities that DHS 
deems high-risk are assigned to one of four tiers based on the magnitude of the facility’s risk. The DHS 
created graduated performance-based standards for facilities assigned to each risk-based tier. Facilities in 
higher risk tiers must meet more stringent standards.^ 


^ Section 550, P.L. 109-295, Department of Homeland Security Appropriations Act. 2007. 

^ The original statutory authority expired on October 4. 2009, three years after enactment. Congress has incrementally extended 
this authority through many appropriation acts and continuing re.so}utions. The Consolidated Appropriations Act, 2014 (P.L. 113- 
76) extends the statutory authority through October 4, 2014. 

72 Federal Register 17688-17745 (April 9, 2(X)7). An interim final rule is a rule that meets the requirements for a final rule and 
that has the same force and effect as a final rule, but contains an invitation for further public comment on its provisions. After 
reviewing comments to the interim final rule, an agency may modify the interim final rule and issue a “final” final rule. The DHS 
first issued the proposed rule in December 2006 and elicited public <»mments. 71 Federal Register 78276-78332 (December 28, 
2006). The DHS has not further modified the interim final rule. 

^ According to the White House Office of Management and Budget, a performance standard is a standard 

that states requirements in terms of required results with criteria for verifying compliance but without stating 
the methods for achieving required results. A performance standard may define the functional requirements 
for the item, operational requirements, and/or interfare and interchangeability characteristics. A performance 
standard may be viewed in juxtaposition to a prescriptive standtuxi which may specify design requirements, 
(continued...) 
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Regardless of their tier assignments, all high-risk facilities must perform a security vulnerability 
assessment, develop an effective site security plan, submit these documents to DHS, and implement their 
security plan. The site security plan must address the security vulnerability assessment by describing how 
activities in the plan correspond to securing facility vulnerabilities, The DHS must review and approve 
the submitted documents, audit and inspect the facilities, and determine regulatory compliance. The DHS 
may disapprove submitted security vulnerability assessments or site security plans that fail to meet DHS 
performance-based standards, but not because of the presence or absence of a specific security measure. 

If, after inspecting a chemical facility, DHS finds that the facility has not complied with the regulatory 
requirements, the Secretary may issue an order to the facility to comply by a specified date. If the facility 
continues to be out of compliance, DHS may fine the facility and, eventually, order it to cease operation. 
The interim final rule establishes the process by which chemical facilities can appeal certain DHS 
decisions and rulings, but the statute prohibits third-party suits for enforcement purposes. 

The statute requires certain protections for information developed by a facility in compliance with the 
statutory requirements. The DHS named this category of information “Chemical-terrorism Vulnerability 
Information” (CVI). The statute directs that judicial and administrative proceedings are to treat CVI the 
same as classified information. 

Implementation 

Administratively, the Infrastructure Security Compliance Division (ISCD), part of the Office of 
Infrastructure Protection in the DHS National Protection and Programs Directorate (NPPD), implements 
CFATS. The ISCD has both a headquarters staff and an inspector cadre associated with regional offices. 
Since FY2007, Congress has appropriated a total of $595 million for ISCD.‘ Annual appropriations for 
this program peaked in FY2010 at $103 million. The President’s Fy2015 request is $87 million. 

The DHS has had challenges in implementing the CFATS regulations, although its performance has 
improved following a 2011 internal review of CFATS program process. As of May 2014, DHS has 
authorized 1,474 site security plans; conducted 1,008 authorization inspections; and approved 719 site 
security plans.’ Over the last six months, DHS has been authorizing 104 and approving 53 site security 
plans monthly. That said, DHS is still in the process of addressing the initial round of submissions from 
regulated facilities. 

Since 2007, DHS has received more than 46,000 submissions of information, known as Top-Screens, 
from over 36,000 chemical facilities. Of these facilities, DHS required more than 7,800 facilities to 
submit a security vulnerability assessment to determine whether they were high-risk. From the submitted 


(...continued) 

such as materials to be used, how a requirement is to be achieved, or how an item is to be fabricated or 
constructed. 

For example, a performance standard might require that a facility perimeter be secured. In contrast, a prescriptive standard might 
dictate the height and type of fence to be used to secure the perimeter. See Office of Management and Budget, The White House, 
“Federal Participation in the Development and Uw of Voluntary Consensus Standards and in Conformity Assessment Activities,” 
Circular A-1 19,'Pebmary 10, 1998. 

® The ISCD also is responsible for regulating ammonium nitrate sale and transfer. Some of its appropriated funding is for this 
purpose. 

’ Department of Homeland Security, Chemical Facility Anti-Terrorism Standards, May 2014, 
http://www.dhs.gov/sites/defauIt/files/publications/CFATS%^U{xlate%20FS_May2014_508_0.pdf. 
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security vulnerability assessments, DHS currently identifies approximately 4,100 facilities as high-risk. 
DHS assigns a preliminary risk tier to the facility based on the submitted Top-Screen data. The DHS 
assigns a final risk tier only after reviewing the facility’s security vulnerability assessment. Since mid- 
2010, between 14% and 22% of high-risk facilities at any given time lack a final tier assignment. 

The DHS has issued 18 risk-based performance standards. One of these performance standards, regarding 
personnel surety, is not yet in force. The ISCD has not fully established the process by which CFATS- 
regulated facilities can meet this performance standard. The DHS issued a series of information collection 
requests from 2009 to 201 1 that described implementation of the personnel surety performance standard,* 
but, in July 2012, DHS withdrew this proposal from Office of Management and Iludget review. The ISCD 
has recently restarted its efforts to establish a process for meeting the personnel surety performance 
standard. In March 2013 and February 2014, DHS released notices of a new information collection 
request for compliance with the CFATS personnel surety program.’ While DHS plans to eventually 
require implementation of the personnel surety program at facilities in each risk tier, it would limit the 
initial program to only Tier 1 and Tier 2 facilities.'” This proposal is under review in the Office of 
Management and Budget. 

The DHS has also experienced challenges in the inspection of facilities. For example, DHS did not meet 
its own expectations regarding when it would begin inspection of regulated facilities. In July 2007, .soon 
after the issuance of the CFATS regulation, DHS testified that formal site inspections of a selected group 
of facilities would begin by the end of the calendar year." In December 2007, DHS testified that facility 
inspection would begin in Fall 2008.'^ In 2009, DHS testified that inspections would begin in the first 
quarter of FY2010." The first authorization inspection took place in July 2010." 

Similarly, DHS has not met its own expectations with regard to inspection and site security plan approval 
milestones. In 2010, DHS testified that it expected to inspect all Tier 1 facilities by the end of calendar 
year 2010.'* In 2011, DHS testified that it expected to inspect all Tier 1 facilities by the end of calendar 
year 2011.'* In 2013, DHS testified that it planned to have all Tier 1 facilities approved by October 
2013." In 2013, DHS also reported that it planned to have all Tier 1 and Tier 2 facilities approved by May 


' Sec 74 Federal Register 27555-27557 (June 10, 2009); 75 Federal Register 18850-18857 (April 13, 2010); and 76 Federal 
Register 34720-24732 (June 14, 201 1). 

’ 78 Federal Register 17680-17701 (March 22, 2013) and 79 Federal Jtegtoer 64 18-6452 (February 3, 2014). 

As of February 20, 2014, 512 of the 4,202 regulated facilities were in Tier 1 and Tier 2. 

' ‘ Testimony of Robert B. Stephan, Assistant Secretary for Infrastructure Protection, National Protection and Programs 
Dircciorate, Dcpartmcni of Homeland Security, before the House Committee on Homeland Security, Subcommittee on 
Transportation Security and Infrastructure, July 24. 2007. 

Testimony of Roben B. Stephan, Assistant Secretary for Infrastructure Protection, National Protection and Programs 
Directorate, Department of Homeland Security, before the House Committee on Homeland Security, Subcommittee on 
Transportation Security and Infrastructure, December 13, 2007. 

Testimony of Philip Reilinger, Deputy Under Secretary, National Protection and Programs Directorate, Department of 
Homeland Security, before the House Committee on Homeland Security, June 16, 2009, 

‘‘‘ House Committee on Energy and Commerce, Subcommittee on Environment and the Economy, Evaluating Internal Operation 
and Implementation of the Chemical Facility Anti-Terrorism Standards [CFATS] Program by the Department of Homeland 
Security, Serial 112-111, February 3, 2012, p. 65 

'•*’ Oral testimony of Rand Beers, Under Secretary, National Protection and Programs Directorate, Department of Homeland 
Security, before the Senate Committee on Homeland Security and Governmental Affairs, March 3, 2010. 

Ora! testimony of Rand Beers, Under Secretary, National Protection and Programs Directorate, Department of Homeland 
Security, before the House Committee on Homeland Security, Subcommittee on Cybersecurily, Infrastructure Protection, and 
Security Technologies, Febroary 1 1, 201 1. 

Te.stimony of Rand Beers, Under Secretary, and David Wulf, Director, Infrastructure Security Compliance Division, National 
(continued...) 
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2014.^^ The DHS did not meet these milestones. It now estimates that, by the end of FY20i4, it will have 
approved over 90% of all Tier 1 and Tier 2 facilities that have authorized site security plans (SSPs).'^ 

At the current level of performance, it appears likely that DHS will require several years to authorize the 
remaining SSPs, and several years beyond that to inspect the facilities and approve the SSPs. That said, 
the pace of DHS authorization, inspection, and approval of site security plans at regulated facilities has 
dramatically increased compared to early phases of the CFATS program. While the CFATS program has 
been in place since 2007, significant reforms that began in 2012 have changed how DHS implements the 
program. Increased efficiencies on the part of the DHS or more effective compliance by regulated 
facilities could further improve program performance. 

Program Reviews 

The CFATS program has undergone external reviews of its processes and progress. Both the DHS Office 
of the Inspector General (OIG) and the GAO released reports in 2013 addressing the CFATS program. 
Based on recommendations arising from these reviews, DHS has reviewed its internal procedures and 
attempted to address challenges identified. 

Office of the Inspector General Review 

In March 2013, the DHS OIG released a report on its review of the CFATS program through the end of 
FY2012.^® The DHS OIG review addressed whether: 

• management controls were in place and operational to ensure that CFATS is not 
mismanaged; 

• NPPD and ISCD leadership misrepresented program progress; and 

• nonconforming opinions of program personnel were suppressed or met with retaliation. 

The DHS OIG report was critical of the prior performance of the CFATS program, stating: 

Program progress has been slowed by inadequate tools, poorly executed processes, and insufficient 
feedback on facility submissions. In addition, program oversight had been limited, and confusing 
terminology and absence of appropriate metrics led to misunderstandings of program progress. The 
Infrastructure Security Compliance Division still struggles with a reliance on contractors and the 
inability to provide employees with appropriate uaining. Overall efforts to implement the program 
have result^ in systematic noncompliance with sound Federal Government internal controls and 
fiscal stewardship, and employees perceive that their opinions have been suppressed or met with 
retaliation. Although we were unable to substantiate any claims of retaliation or suppression of 


(...continued) 

Protection and Programs Directorate, Department of Homeland Security, before the House Committee on Energy and Commerce, 
Subcommittee on Environment and the Economy, March 14, 2013. 

Office of the Inspector General, Department of Hormland Security, Effectiveness of the Infrastructure Security Compliance 
Division's Management Practices to Implement the Chemical Facility Anti-Terrorism Standards Program, OIG-13-55, March 
2013, p. 22. 

Communication between Office of Legislative Affairs, Department of Homeland Security, and CRS, October 25, 2013. 

Office of the Inspector General, Department of Homeland Security, Effectiveness of the Infrastructure Security Compliance 
Division's Management Practices to Implement the Chemical Facility Anti-Terrorism Standards Program, OIG-13-55, March 
2013. 
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nonconforming opinions, the Infrastructure Security Compliance Division work environment and 
culture cultivates this perception. Despite the Infrastructure Security Compliance Division’s 
challenges, the regulated community views the Chemical Facility Anti-Terrorism Standards Program 
as necessary in establishing a level playing field across a diverse industry.^^ 

The DHS OIG issued 24 recommendations to assist ISCD to correct identified program deficiencies and 
attain intended program results and outcomes. The ISCD concurred fully or partially with 20 
recommendations and did not concur with 4 recommendations. The DHS OIG recommendations included 
improving internal processes to achieve a more timely response to information submissions and requests 
from regulated entities; defining, developing, and implementing improved processes and procedures for 
inspections; refining and improving the existing CFATS tiering methodology and tiering process; and 
reducing reliance on contractors and improving managerial oversight within ISCD. 

In response to these recommendations, ISCD provided the DHS OIG with a corrective action plan. As of 
February 2014, ISCD has addressed 12 of the DHS OIG recommendations. Nine recommendations were 
administrative and include selecting permanent ISCD leadership; reducing reliance on contract personnel; 
developing policy for appointing acting management; ensuring that all employees serving in an acting 
supervisory capacity have a supervisory position description; ensuring that all employees receive 
performance reviews; disseminating ISCD organizational and reporting structure to staff; reiterating to all 
employees the process for reporting misconduct allegations; implementing a plan to ensure the long-term 
authorization of the CFATS Program; and establishing internal controls for the accountability of 
appropriated funds. Three recommendations were programmatic and pertained to: revising the long-term 
review process to reduce the site security plan backlog; implementing a process to improve the timeliness 
of facility submission determinations; and program metrics that measure CFATS program value 
accurately and demonstrate the extent to which risk has been reduced at regulated facilities.^ 

The ISCD is still addressing 12 DHS OIG recommendations. Ten recommendations are programmatic and 
include improving CFATS Program tools and processes; engaging regulated industry and government 
partners; and finalizing program requirements. The two administrative recommendations include 
providing training and guidance; and eliminating inappropriate Administratively Uncontrollable Overtime 

pay.^’ 

Government Accountability Office Review 

In April 2013, GAO issued a report on the CFATS program.^** The GAO assessed how DHS assigned 
chemical facilities to tiers and the extent to which it did so, how DHS revised its process to review facility 
security plans, and whether DHS communicated and worked with owners and operators to improve 
security. The GAO found that the approach DHS used to assess risk and make decisions to place facilities 


Office of the Inspector General, Department of Homeland Security, Effectiveness of the Infrastructure Security Compliance 
Division’s Management Practices to Implement the Chemical Facility Anti-Terrorism Standards Program, OIG-13-55, March 
2013, p. 1. 

Testimony of Marcia Moxey Hodges, Chief Inspector, Office of Inspections, Office of the Inspector General, Department of 
Homeland Security, before the Subcommittee on Cybersecurily, Infrastructure Protection, and Security Technologies, House 
Committee on Homeland Security. February 27, 2014. 

^ Testimony of Marcia Moxey Hodge.s, Chief Inspector, Office of Inspections, Office of the Inspector General, Department of 
Homeland Security, before the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, House 
Committee on Homeland Security, February 27, 2014. 

Government Accountability Office, Critical Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk and 
Gather Feedback on Facility Outreach Can Be Strengthened, GAO- 1 3-353, April 2013. 
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in final tiers does not consider all of the elements of consequence, threat, and vulnerability. For example, 
the risk assessment approach is based primarily on consequences arising from human casualties, but does 
not consider economic consequences. In addition, GAO found that DHS had not been tracking data on 
reviews of site security plans and thus could not quantify improvements to that process. The GAO 
estimated that it could take another seven to nine years tefore DHS completed reviews on submitted site 
security plans. Input GAO solicited from 1 1 trade associations also indicated that DHS does not obtain 
systematic feedback on outreach activities. The GAO recommended that DHS: 

• develop a plan, with timeframes and milestones, that incorporates the results of the 
various efforts to fully address each of the components of risk and take associated actions 
where appropriate to enhance ISCD’s risk assessment approach and 

• conduct an independent peer review, after ISCD completes enhancements to its risk 
assessment approach that fully validates and verifies ISCD’s risk assessment approach 
consistent with the recommendations of the National Research Council of the National 
Academies. 

The ISCD has taken steps to address the GAO recommendations. For example, ISCD engaged the 
Homeland Security Studies and Analysis Institute to coordinate an examination of the CFATS risk 
assessment model. According to GAO, HSSAI recommended that ISCD revise the current risk-tiering 
mode! and create a standing advisory committee — with membership drawn from government, expert 
communities, and stakeholder groups — to advise DHS on significant changes to the methodology. In 
addition, ISCD plans to modify the risk assessment approach to better include all elements of risk and has 
developed an accompanying implementation plan. Finally, DHS is engaged with Sandia National 
Laboratory to assess how to include economic consequences into their risk tiering approach.^ 


Policy Considerations 

Congressional policy makers have considered chemical facility security legislation in each Congress since 
the 109"’ and have introduced legislation in the 113"' Congress. Some of the policy issues raised during 
congressional consideration of such legislation include: how to assess facility risk; whether to employ 
third-party employees as inspectors to improve program performance; whether DHS should be allowed to 
mandate the use of certain approaches or chemical process best practices, sometimes known as inherently 
safer technologies or methods to reduce the consequences of terrorist attack; which facilities should be 
regulated as chemical facilities; and how to identify non-responsive facilities. 

Risk Assessment 

The risk-based tier assignment process has presented challenges to DHS. The DHS has identified 
anomalies in its risk assessment tools that led to approximately 500 facilities receiving erroneous tier 
assignments. Additionally, GAO has identified other factors DHS should include in calculating security 
risk for CFATS facilities. The DHS is in the process of receiving additional recommendations and 
analysis to determine how to best address these recommendations in the risk-based tier assignment 
process. 


Government Accoumabitity Office. Critical Infrastructure Protection: Observations on DHS Efforts to Identify, Prioritize. 
Assess and Inspect Chemical Facilities, GAO-14-365T, Febniaiy 27, 2014; and Personal Communication with DHS, May 8, 
20!4. 
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In May 2010, DHS identified an anomaly in one of the risk-assessment tools it was using to determine a 
facility’s risk tier. At that time, DHS believed that it had resolved the anomaly. In June 2011, a new acting 
ISCD Director “rediscovered” this issue, identified its potential effect on facility tiering, brought the issue 
to the attention of NPPD leadership,® and notified numerous facilities of a change in their risk tier.” 
Subsequent review of the risk-assessment tool resulted in DHS reviewing the tier determination of 
approximately 500 facilities. In some cases, DHS determined that facilities no longer qualified as high- 
risk and thus were no longer subject to the CFATS regulations. 

In April 2013, GAO issued a report on the CFATS program.® The GAO found that the approach DHS was 
using to assess risk and place facilities in final tiers did not consider all elements of consequence, threat, 
and vulnerability. The GAO review of the risk assessment approach revealed that ISCD was inconsistent 
in how it assessed threat. According to GAO, ISCD consider^ threat for the 10 percent of facilities tiered 
because of the risk of release or sabotage, but not for the approximately 90 percent of facilities that are 
tiered because of the risk of theft or diversion. Also, GAO identified that when it did use threat data, the 
data were not current. The DHS subsequently engaged in an additional review of these issues and is 
considering improvements to its process. 

When developing its interim final rule, DHS estimated the number of facilities it expected to be regulated 
primarily because of the threat from a potential release and the number regulated due to the potential for 
theft or diversion of chemicals,® In 2012, DHS analyzed facilities with final tier assignments and 
identified their primary risk category. The actual distribution of facilities did not align with how DHS had 
estimated in 2007. In 2007, DHS estimated that 62% of regulated chemical facilities would be relea.se 
facilities.™ In 2012, only 13% of the regulated facilities were release facilities.” This could be a 
significant issue for policy makers. It potentially reflects a shift in regulatory focus away from the threat 
of release to the surrounding community toward the threat of theft for later use as a weapon. Alternatively, 
this might reflect an unequal treatment of risk by DHS when considering release and theft from facilities. 

Congressional policy makers may be interested in the extent to which changes in the way DHS 
determines risk affects the regulated community and the plans that DHS has to minimize its financial 
impact. The mechanisms by which DHS determines the risk of the regulated facilities is a key 
consideration for the CFATS regulatory program. Changes to these mechanisms may have significant 
impacts on the regulated community. Depending on what changes are made, facilities might be given a 
higher or lower tier assignment or be found no longer high-risk. Other facilities currently not considered 
high-risk might become regulated. As the CFATS program continues into its implementation, investment 
by the regulated community in required security measures will continue to increase as DHS approves an 
increasing number of site security plans. 


Ora! testimony of Rand Beers, Under Secretary, National Protection and Programs Directorate, Department of Homeland 
Security, before the House Committee on Energy and Commerce, Subcommittee on Environment and the Economy, February 3, 
2012 . 

Department of Homeland Security, “DHS Notifies Chemical Facilities of Revised Tiering Assignments,” July 5, 201 1, 
http://www.dhs.gov/fiies/programs/cfats-revised-tiering-assignments.shtm. 

Government Accountability Office, Critical Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk and 
Gather Feedback on Facility Outreach Can Be Strengthened, GAO-13-353, April 2013. 

Note that a facility might be primarily regulated for one category but also qualify under the other. 

Department of Homeland Security, Chemical Facility Anti-Terrorism Standards Interim Final Rule Regulatory Assessment, 
DHS-2006-0073, April !, 2007. 

79 Federal Register 6418-6452 (February 3, 2014) at 6438. 
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Third-Party Inspection 

DHS inspects regulated chemical facilities using a federal inspector cadre, known as Chemical Security 
Inspectors. These DHS employees manage, coordinate, and conduct inspections, compliance assistance 
visits, and outreach activities.^^ 

DHS had previously considered using DHS-certifled third-party inspectors as part of its regulatory 
program and had implied that its existing statutory authority allows such use.^^ Several policy issues were 
raised at that time. They included whether such inspections should be performed solely by federal 
employees; what third-party entities might be appropriate to perform CFATS inspections; and how to 
harmonize training and inspection standards between federal and third-party inspectors. These issues are 
discussed below. 

Inherently Governmental Functions 

Policy makers have weighed the appropriate role of federal versus nonfederal employees in CFATS 
inspections. Some government functions are considered as inherently governmental, meaning they must 
be performed by government employees and cannot be contracted out.^"* The most recent policy guidance 
for federal agencies on inherently governmental and related functions was released in September 2011.^^ 
This policy guidance describes three categories of functions: 

• inherently governmental functions, 

• functions closely associated with the performance of inherently governmental functions, 
and 

• critical functions.^® 

While inherently governmental functions must be performed by government employees, functions closely 
associated with the performance of inherently governmental functions and critical functions may be 
performed by either federal employees or contractors.^’ 

The DHS itself has raised questions about “whether it is appropriate for DHS to use third-party auditors 
and if so, for which tiers of facilities; what the standards and requirements would be for those third-party 
auditors; and who would pay for third-party auditors.”^* That said, the most recent policy guidance 


As of October 2012, DHS had 101 Chemical Security Inspectors located in 10 regional areas organized in three districts across 
the United States. DHS had an additional 1 3 regional and district commanders to oversee the Chemical Security Inspectors. 
Office of Inspector General, Department of Homeland Security, Effectiveness of the Infrastructure Security Compliance 
Division's Management Practices to Implement the Chemical Facility Anti-Terrorism Standards Program, OIG-13-55, March 
2013. 

^^71 Federal Registerl%216-l%12\ (December 28, 2006). 

For an analysis of the various definitions of “inherently government functions,” See CRS Report R42325, Definitions of 
“Inherently Governmental Functions” in Federal Procurement Law and Guidance, by Kate M. Manuel. 

76 Federal Register 56227-56242 (September 12, 201 1). 

For a more thorough analysis of the policy letter, see CRS Report R42039, Performance of Inherently Governmental and 
Critical Functions: The Obama Administration’s Final Policy Letter, by KateM. Manuel, L. Elaine Halchin, and Erika K. 
Lunder. See also CRS Report R42325, Definitions of “Inherently Governmental Functions" in Federal Procurement Law and 
Guidance, by Kate M. Manuel. 

76 Federal Register 56227-56242 (September 12. 2011) at 56241. 

72 Federal Register 17688-17745 (April 9, 2007) at 17712. 
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contains examples of both inherently governmental functions and functions closely associated with the 
performance of inherently governmental functions.” The approval of federal licensing actions and 
inspections is listed as an inherently governmental function. Provision of inspection services is listed as a 
function closely associated with the performance of inherently governmental functions. 

Identity of Third-Party Inspectors 

The DBS has a range of entities that might be employed as third-party in.spectors, including private sector 
companies, state agencies, or other federal agencies. Some other federal agencies already employ 
contractors to conduct inspections to assess compliance with federal regulatory requirements. For 
example, the Environmental Protection Agency <EPA) uses both federal and contract staff to inspect 
federal facilities for compliance with some federal environmental regulations. According to EPA, properly 
trained and authorized contract inspectors are appropriate for federal facility compliance inspections and 
evaluations under the Clean Water Act (CWA), the Resource Conservation and Recovery Act (RCRA), 
the Toxic Substances Control Act (TSCA), the Oil Pollution Act (OPA), and the Safe Drinking Water Act 
(SDWA).* The EPA has also identified EPA contract inspectors as eligible to assess compliance under the 
Comprehensive Environmental Response, Compensation and Liability Act (CERCLA). 

Additionally, both the EPA and the Nuclear Regulatory Commission (NRC) may delegate certain 
responsibilities to state olficials. The EPA delegates an assortment of environmental authorities to states.® 
The authority for these delegations is generally in statute. Under the Atomic Energy Act of 1954 (PL. 83- 
703, as amended), the NRC may relinquish to states portions of its regulatory authority to license and 
regulate radioactive materials. Under the EPA and NRC authorities, states generally must promulgate 
regulations that are at least as stringent as the federal requirements.'” When approved, these states then 
regulate in lieu of the federal requirements. These agreements are documented through approval by senior 
agency officials. 

Certification of Third-Party Inspectors 

Since the current inspector cadre is composed of federal employees, stakeholders might reasonably expect 
that their qualifications and performance meet DBS standards. If DBS was to use other federal agency, 
state, or contract employees as inspectors, the regulated community might wish greater transparency in 
how DBS is assessing these inspectors’ skills and training in order to have equal confidence in 
equivalency between DBS and non-DBS inspectors. The DBS might develop such stakeholder 
confidence by setting contractor minimum capabilities through contract requirements; rigorously 
verifying contract inspector knowledge and skills; and providing inspection guidance available to the 
regulated community. 


76 Federal Register 5S211-S62A2 (September 12, 201 1) at 56241. 

David J. Klitig, Director, Federal Facilities Enforcement Office, Office of Enforcement and Compliance Assurance, 
Environmental Protection Agency, “Clarification on the Use of Contract Inspectors for EPA’s Federal Facility Compliance 
Inspections/Evaluations,” Memorandum to Regional Federal Facilities Senior Managers and Program Managers, September 19, 
2006. 

http://www.epa.gov/compliance/resources/pubiications/federalfaeilities/compiiance/accessbrochure.pdf. 

For an overview of federal environmental laws, including delegation to states, .see CRS Report RL30798, Environmental Laws: 
Summaries of Major Statutes Administered by the Environmental Protection Agency, coordinated by David M. Bearden, and CRS 
Report RL34384, Federal Pollution Control Imws: How Are They Enforced?, by Robert Esworthy. 

In some cases, such as regulation of underground storage tanks, states may directly enforce EPA regulations. 
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Capacity and Timing 

Fundamental to the issue of third-party inspection is whether the existing DHS inspector cadre has 
sufficient capacity to perform the necessary inspections in a time period meeting congressional 
expectations. If some of the challenges to CFATS program performance arise from insufficient inspection 
capacity, third-party inspectors might augment the capacity of the inspection cadre. This increased 
inspection capacity might lead to a commensurate increase in the rate of authorization inspection, site 
security plan approval, and compliance inspection of CFATS-reguIated facilities. In contrast, if some of 
the challenges to CFATS program performance arise from factors outside of the inspector cadre, such as 
review of submitted documentation, use of third-party inspectors might have a minimal effect on 
performance. 

A key question is whether the use of third-party inspectors is intended to accelerate the rate of inspection 
in the short or long term. An increase in the number of inspectors may not yield results as quickly as some 
policy makers might expect. The DHS likely would have to develop policy and procedure for the 
acquisition of non-DHS and nongovernmental inspectors. Once these inspectors were hired, either as 
federal employees or under contract, they would likely need to undergo CFATS-specific training and 
certification activities. Thus, there would likely be a delay between DHS receiving the authority and DHS 
deploying third-party inspectors to perfoim inspections. 

Inherently Safer Technologies 

Congressional policy makers may choose to address the issue of inherently safer technologies, sometimes 
called methods to reduce the consequences of terrorist attack. The current statute bars DHS from 
mandating the presence or absence of a particular security measure. Therefore, DHS cannot require a 
regulated facility to adopt or consider inherently safer technologies. Congress could choose to continue 
the current policy or provide DHS with statutory authority regarding inherently safer technologies at 
regulated chemical facilities or require efforts regarding inherently safer technologies. 

The Obama Administration has stated its support of inherently safer technologies to enhance security at 
high-risk chemical facilities in some circumstances. The DHS has testified that the Administration 
believes that all facilities regulated under CFATS should be required to assess inherently safer technology 
methods at their facilities. In addition, regulators should be able to require implementation of inherently 
safer technology methods at Tier 1 and Tier 2 facilities, if such methods demonstrably enhance overall 
security and are determined to be feasible.*^ 

A fundamental challenge for inherently safer technologies is how to compare one technology with its 
potential replacement. It is difficult to unequivocally state that one technology is inherently safer than 
another without adequate metrics. Risk factors may exist outside of the comparison framework, and 
analyses may become narrowly focused and their outcomes inappropriately weighted."*^ Some experts 


Testimony of Rand Beers, Under Secretary, National Protection and Programs Directorate, Department of Homeland Security, 
before the Senate Committee on Homeland Security and Governmental Affaire, March 3. 2010; and Personal Communication 
between CRS and Office of Legislative Affairs, Department of Homeland Security, January 16, 2014. 

For example, the replacement of hydrogen fluoride with sulfuric acid for refinery processing would replace a more toxic 
chemical with a less toxic one. In this case, experts estimate that equivalent processing capacity would require 25 times more 
sulfuric acid. Thus, more chemical storage facilities and transportation would be required, potentially posing different dangers 
than atmospheric release to the surrounding community, Delmraning which chemical process had less overall risk might require 
considering factors both internal and external to the chemical facility and the surrounding community. See testimony of M. Sam 
Mannan, Director, Mary Kay O’ Connor Process Safety Center, Texas A&M University, before the House Committee on 
(continued...) 
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have asserted that the metrics for comparing industrial processes are not yet fully established and need 
additional research and study.“ 

Supporters of adopting inherently safer technology as a way to improve chemical facility security argue 
that reducing or removing chemicals of interest from a facility will reduce the incentive to attack the 
facility. They suggest that reducing the consequences of a release also lowers the threat from terrorist 
attack and mitigates the risk to the surrounding populace. Some facilities have voluntarily changed 
amounts of chemicals on hand or chemical processes in use. Supporters of adopting inherently safer 
technology cite these as examples that facilities can implement such an approach in a cost-effective, 
practical fashion.” 

Opponents of mandating inherently safer technologies question this approach. Industrial entities assert 
that these are safety, not security, methods; that process safety engineers within the regulated industry 
already employ such approaches in a safety context; and that process safety experts and business 
executives should determine the applicability and financial practicality of changing existing processes at 
specific chemical facilities."’* Additionally, some stakeholders question whether the federal government 
contains the required technical expertise to adjudicate the practicality and benefit of alternative 
technological approaches.® Opponents of an inherently safer technology mandate also state concern that 
few existing alternative approaches are well understood with regard to their unanticipated side effects.® 

One policy approach might be to mandate the implementation of inherently safer technologies for a set of 
processes. Another policy approach might be to mandate the consideration of implementation of 
inherently safer technologies with certain criteria controlling whether implementation is required. A third 
policy approach might be to mandate the development of a federal repository of inherently safer 
technology approaches and consideration of chemical processes against those options listed in the 
repository. Alternatively, policy makers might e,stablish an incentive-based structure to encourage the 
adoption of inherently safer technologies by regulated entities. To some extent the CFATS regulation 
provides such an incentive, since DHS may assign facilities that reduce or eliminate the amount of 


(...continued) 

Homeland Security, December 12, 2007; and Committee on Inherently Safer Chemical Processes, National Research Council, 
The Use of Methyl Isocyanate (MIC) at Bayer CropScience, 2012. 

Committee on Assessing Vulnerabilities Related to the Nation’s Chemical Infrastructure, National Research Council, 

Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities, 2006; and Testimony of M. Sam 
Mannan, Direaor, Mary Kay O’Connor Process Safety Center, Texas AtfeM University, before the House Committee on 
Homeland Security, December 12, 2007. 

See, for example. Paul Orum and Reece Rushing, Center for American Progress, Preventing Toxic Terrorism: How Some 
Chemical Facilities Are Removing Danger to American Communities, April 2006; and Paul Orum and Reece Rushing. Center for 
American Progress, Chemical Security 101: What You Don 't Have Can 't Leak, or Be Blown Up by Terrorists, November 2008. 

See, for example, testimony of Timothy J. Scott, Dow Chemical Company, before the House Committee on Homeland 
Security, Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, February 1 1 , 20 1 1 ; and 
testimony of Marty Durbin, Managing Director, Federal Affairs, American Chemistry Council, before the House Committee on 
Energy and Commerce, Subcommittee on Environment and Hazardous Materials, June 12, 2008. 

See, for example, testimony of M. Sam Mannan, Director, Mary Kay O’Connor Process Safety Center, Texas A&M 
University, before the House Committee on Homeland Security, Subcommittee on Cybersecurity, Infrastructure Protection, and 
Security Technologies, February 11,2011; testimony of Dennis C. Hendershot, Staff Consultant, Center for Chemical Process 
Safety, American Institute of Chemical Engineers, before the Senate Committee on Environment and Public Works, June 21, 
2006, S.Hrg. 109-1044; and testimony of Matthew Barm^se, Synthetic Orgtmic Chemical Manufacturers Association, before die 
Senate Committee on Homeland Security and Governmental Affairs, July 13, 2005. 

For example, EPA experts have pointed to the change by drinking water treatment facilities between two approved 
disinfectants — chlorine and chloramine — as correlated with an unexpected increase in levels of lead in drinking water due to 
increased corrosion. Government Accountability Office, Lead in D.C. Drinking Water, GAO-05-344, March 2005. 
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chemicals of interest they store to lower risk tiers. More than 3,000 facilities have removed or reduced the 
amount of chemicals of interest stored onsite and no longer qualify as a high-risk facility. 

Definition of Chemical Facility 

The DHS regulates an assortment of facilities that possess and manufacture chemicals of interest. The 
term chemical facility encompasses many types of facilities. These include chemical manufacturers and 
distributors, agricultural facilities, universities, and others. Because DHS defines chemical facilities 
according to possession of a chemical of interest, it regulates facilities that are not part of the chemical 
manufacturing and distributing chain. 

As mentioned above, the statutory authority underlying CFATS exempts several types of facilities, 
including water and wastewater treatment facilities. Thus, the federal government does not regulate water 
and wastewater treatment facilities for chemical security purposes. Instead, current chemical security 
efforts at water and wastewater treatment facilities are voluntary.^* Some advocacy groups have called for 
inclusion of currently exempt facilities, such as water and wastewater treatment facilities.^^ Some water 
and wastewater treatment facilities possess amounts of chemicals of interest that would lead to regulation 
if located at a non-exempt facility. Advocates for their inclusion in security regulations cite the presence 
of hazardous chemicals and their relative proximity to population centers as reasons to mandate security 
measures for such facilities. In contrast, representatives of the water sector point to the critical role that 
water and wastewater treatment facilities have in daily life. They caution against including these facilities 
in the existing regulatory framework because of the potential for undue public impacts. They cite, for 
example, loss of basic fire protection and sanitation services if the federal government were to order a 
water or wastewater utility to cease operations for security reasons or failure to comply with regulation.^* 

If Congress was to remove the water and wastewater treatment facility exemption, the number of 
regulated facilities might substantially increase, placing additional burdens on the CFATS program. The 
United States contains approximately 52,000 community water systems and 16,500 wastewater treatment 
facilities;"*^ These facilities vary substantially in size and service area. The number of regulated facilities 
would depend on the criteria used to determine inclusion, such as chemical possession or number of 
individuals served. It is likely that only a subset of these facilities would meet a regulatory threshold.^® In 


Congress required certain water facilities to perform vulnerability assessments and develop emergency response plans through 
Section 401 of P.L. 107-188, the Public Health Security and Biolcrrorism Preparedness and Response Act of 2002. For more 
information on water security activities, see CRS Report RL3 1294, Safeguarding the Nation 's Drinking Water: EPA and 
Congressional Actions, by Mary Tiemann. 

See, for example, Paul Orum and Reece Rushing, Center for American Progress, Chemical Security 10 1: What You Don’t 
Have Can’t Leak, or Be Blown Up by Terrorists, November 2008; and testimony of Philip J. Crowley, Senior Fellow and 
Director of Homeland Security, Center for American Progress, before the House Committee on Energy and Commerce, 
Subcommittee on Environment and Hazardous Materials. June 12, 2008, 

See U.S. Environmental Protection Agency, Factoids: Drinking Water and Ground Water Statistics for 2008, EPA 816-K-08- 
004, November 2008; and U.S. Environmental Protection Agency, Clean Watersheds Needs Survey 2004: Report to Congress, 
January 2008. 

American Water Works Association, “Chemical Facility Security,” Fact Sheet, 2009. For more information on security issues 
in the water infrastructure sector, see CRS Report RL32189, Terrorism and Security Issues Facing the Water Infrastructure 
Sector, by Claudia Copeland. 

See U.S. Environmental Protection Agency, Factoids: Drinking Water and Ground Water Statistics for 2008, EPA 8!6-K-08- 
004, November 2008; and U.S. Environmental Protection Agency, Clean Watersheds Needs Survey 2004: Report to Congress, 
January 2008. For comparison, more than 36,000 chemical fodlities filed a Top-Screen under CFATS. 

For example, the number of individuals served by the water facility might be used a.s a regulatory criterion. Section 401 of the 
Public Health Security and Bioterrorism Prep^edness and Response Act of 2002 (P.L. 107-188) mandated drinking water 
(continued...) 
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2011, a DHS official testified that approximately 6,000 such facilities would likely meet the CFATS 
reporting threshold.” 

Another option might be to grant statutory authority to regulate water and wastewater treatment facilities 
for security purposes to EPA, Some water-sector stakeholders suggest that this approach would be more 
efficient. Providing EPA the authority to oversee security as well as public health and safety might reduce 
the potential for redundancy and other inefficiencies.^* 

If policy makers were to assign responsibility for chemical facility security at different facilities to 
different agencies, each agency would promulgate separate rules. These rules might be similar or different 
depending on the agencies’ statutory authority and inteipretation of that authority, the ability of the 
regulated entities to comply, and any interagency coordination that might occur. Some industry 
representatives have expressed concern regarding the effects of multiple agencies regulating security at 
water and wastewater treatment facilities.*’ They assert that municipalities that operate both types of 
facilities might face conflicting regulations and guidance if different agencies regulate water and 
wastewater treatment facilities. Congress may wish to assess the areas where such facilities are similar 
and different in order to provide authorities that meet any unique characteristics. 

Any new regulation of water and wastewater treatment facilities is likely to cause the regulated entities, 
and potentially the federal government, to incur some costs. Representatives of the water and wastewater 
sectors argue that local ratepayers will eventually bear the capital and ongoing costs incurred due to 
increased security measures.® Congressional policy makers may wish to consider whether the regulated 
entities and the customers they serve should bear these costs, as is done for other regulated chemical 
facilities, or whether they should be borne by the taxpayers in general through federal financial assistance 
to the regulated entities. Additionally, if inclusion of other facility types significantly increases the 
number of regulated entities, the regulating agency may require additional funds to process regulatory 
submissions and perform required inspections. 

Identification of Non-Responsive Facilities 

Although facilities with greater than screening threshold quantities of chemicals of interest must submit 
information to DHS under the Top-Screen process, an unknown number of facilities do not provide such 
information. A well-known example is the West Fertilizer Company, which reported more than a 
threshold amount of a chemical of interest to the EPA under the Risk Management Plan (RMP) program 


(...continued) 

facilities serving more than 3,300 individuals develop an emergency response plan and perform a vulnerability assessment. 
Approximately 8,400 community water systems met this requirement in 2002. For more information on drinking water security 
activities, see CRS Report RL3 1 294, Safeguarding the Nation ’s Drinking Water: EPA and Congressional Actions, by Mary 
Tiemann. 

Ora! testimony of Rand Beers, Under Secretary, National Protection and Programs Directorate, Department of Homeland 
Security, before the House Committee on Homeland Security. Subcommittee on Cybersecurity, Infrastructure Protection, and 
Security Technologies, February 1 1 , 201 1. 

Some agencies oversee both safety and security issues. For example, the U.S. Coast Guard has both safety and security 
responsibilities for ports. 

See, for example, American Water Works Association, “AWWA Members Urged to Contact Congress on Chemical Security 
Bill,” and Association of Metropolitan Water Agencies, “Drinking Water Security and Treatment Mandates,” Policy Resolution, 
October 2008. 

^ Testimony of Brad Coffey, Association of Metropolitan Water Agencies, before the House Committee on Energy and 
Commerce, Subcommittee on Environment and Hazardous Matoials, June 12, 2008. 
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but did not file with DHS under CFATS. One limited survey of community hospitals reported that 50% of 
respondents were unaware of CFATS reporting requirements.®' The DHS refers to non-compliant facilities 
as “outliers.” Congressional policy makers have raised the concern that many facilities may still not have 
properly reported to DHS.®^ 

The total number of facilities not complying with CFATS reporting requirements is not known. If DHS 
lacks information about a facility’s chemical holdings, it is unlikely to be able to identify it as an outlier. 
Comparing federally held information on regulated facilities with data held by other sources may be 
effective in identifying outliers. In order to identify such facilities, DHS has engaged with EPA regarding 
RMP data. In 201 3, DHS identified 3,362 facilities as potential outliers through this effort; approximately 
900 have subsequently filed a Top-Screen while 522 facilities have not responded to DHS. According to 
DHS, ISCD plans to continue to compare EPA RMP data, as well as the Superfund Amendments and 
Reauthorization Act Title III data from all 50 individual state data sets, on an annual basis to identify 
facilities that are potentially non-compliant with the CFATS regulation.® Each discrepancy between the 
data sets will then be investigated and resolved to ensure reporting facilities adhere to all regulatory 
obligations. 

In August 2013, President Obama issued Executive Order 13650, Improving Chemical Facility Safety and 
Security.^ The White House is coordinating a review under this executive order of chemical safety and 
security regulations across departments and agencies to identify gaps in coverage and explore ways to 
mitigate those gaps through existing authorities. This effort is still in progress. 


Analysis of H.R. 4007 

H.R. 4007, the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability 
Act of 2014, was referred to the House Committee on Energy and Commerce and the House Committee 
on Homeland Security. On April 3, 2014, the Subcommittee on Cybersecurity, Infrastructure Protection, 
and Security Technologies, of the House Committee on Homeland Security, amended the bill as 
introduced and ordered it forwarded to the full Committee with a favorable recommendation, as amended. 
On April 30, 2014, the House Committee on Homeland Security amended the bill as reported by the 
Subcommittee and ordered it to be reported to the House of Representatives with a favorable 
recommendation, as amended. 


Hospitals may store chemicals of interest above screening threshold quantities and thus become regulated under CFATS. 
Morgan M. Bliss, Kiril D. Hristovski, and Jon W. Ulrich. “Compliance of Community Hospitals with the Chemical Facility Anti- 
Terrorism Standards (CFATS) in the Western United States” Journal of Homeland Security and Emergency Management, 10(2), 
2013, pp. 433-445. 

Representative Michael T. McCauI, Chairman, Committee on Homeland Security; Representative Fred Upton, Chairman, 
Committee on Energy and Commerce; and Representative John Carter, Chairman, Homeland Security Appropriations 
Subcommittee, Letter to Janet Napolilano, Secretary, U.S. Department of Homeland Security, July 22, 2013; Senator Tom 
Carper, Chairman, Committee on Homeland Security and Governmental Affaire, Letter to Janet Napolilano, Secretary, and 
Suzanne Spaulding, Acting Under Secretary, National Protection and Programs, U.S. Department of Homeland Security, June 
28, 2013; and Representative Henry A. Waxman, Ranking Member, Committee on Energy and Commerce, and Representative 
Bennie G. Thompson, Ranking Member, Committee on Homeland Security, Letter to President Barack Obama, May 2, 2013. 

Department of Homeland Security, National Protection and Programs Directorate, Infrastructure Protection and Information 
Security Fiscal Year 2015 Congressional Justification, p. 90. 

^ Executive Order 13650, Improving Chemical Facility Safety and Security, August 1. 2013. See 78 Federal Register AZ029-- 
48032 (August 7, 2013). 
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H.R. 4007 has similarities with the existing statute. The bill incorporates much of the language in the 
existing statutory authority. It would require the Secretary of Homeland Security to establish risk-based 
performance standards and mandate that covered facilities submit security vulnerability assessments and 
develop and implement site security plans. The act as amended would require the Secretary to review and 
approve or disapprove such security vulnerability assessments and site security plans. H.R. 4007 prohibits 
the Secretary from making such approval or disapproval on the basis of the presence or absence of a 
particular security measure, which maintains the inability of DHS to require implementation of inherently 
safer technologies. H.R. 4007 would maintain existing statutory exemptions, information protection 
requirements, and preempt state law or regulation only in the case of an "actual conflict.” 

H.R. 4007, as amended, and the existing statute have key differences. These are briefly described below. 

• H.R. 4007, as amended, lacks a termination date for the statutory authority. The current 
statutory authority will terminate on October 4, 2014. The authority granted under H.R. 

4007 would be permanent. 

• H.R. 4007, as amended, would specify that the CFATS risk assessment approach and 
tiering methodology would be based on all relevant elements of risk, including threat, 
vulnerability, and consequence. It further specifies the criteria to include relevant threat 
information, the potential economic consequences of a terrorism incident at the facility 
and the potential loss of human life, as well as the vulnerability of the facility to certain 
terrorist events. This differs from the existing statute, which does not specify how to 
consider security risk, 

• H.R. 4007, as amended, would expressly allow the Secretary to use third-party inspectors 
rather than federal employees in the inspection process. While DHS had implied that it 
had such authority, H.R. 4007, as amended, would codify this authority. 

• H.R. 4007, as amended, would provide certain limitations on the Secretary with respect 
to issuing a personnel surety standard. As mentioned above, DHS has issued a personnel 
surety proposal, but provisions in H.R. 4007, as amended, would conflict with this 
proposal. Specifically, H.R, 4007, as amended, would require DHS to accept certain 
credentials beyond those identified in its personnel surety proposal, prohibit DHS from 
requiring information on as many types of individuals as DHS planned, and require 
greater information sharing than DHS had proposed. 

• H.R. 4007, as amended, would codify certain activities undertaken through the 
Secretary's discretion. One is mandating the acceptance of reviewed and approved 
alternative security programs in lieu of a site security plan. The other is creating an 
exemption for rail facilities handling hazardous materials. In both cases, DHS has 
implemented these actions through its rulemaking. 

• H.R, 4007, as amended, would amend the Homeland Security Act of 2002 by creating a 
new title, Title XXI, called Chemical Facility Anti-Terrorism Standards. The existing 
statute is free standing, not part of the Homeland Security Act. 

• H.R. 4007, as amended, would require DHS to plan and perfomi certain outreach 
activities, support small chemical facilities, and issue reports to Congress on various 
aspects of the CFATS program, certifying its progress and development of a risk 
assessment approach. It would also require a semiannual GAO report to Congress 
assessing the act’s implementation. 
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Thank you for the opportunity to appear before the committee. I would be happy to address any questions 
you may have. 
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Chairman Carper, Ranking Member Coburn and members of the Committee, thank you for the 
opportunity to testify today. My name is Anna Fendley. I am here on behalf of the United Steel, Paper and 
Forestry, Rubber, Manufacturing, Energy, Allied Industrial and Service Workers international Union - USW for 
short. We represent 850,000 workers in the sectors I just mentioned and many others, including the majority 
of unionized workers in the chemical industry and hundreds of thousands of men and women whose 
workplaces use and store large quantities of industrial chemicals. 

Our members are well aware of the hazards and the potential for widespread damage to critical 
infrastructure and the communities where they work and live. Small accidental releases occur more often than 
the public realizes, and it is only a matter of time before the next large explosion or release. I spoke recently 
with one of our members at a chemical plant on the west coast. He described a norma! procedure that turned 
atypical several months ago and caused a release of sulfuric acid that sent workers at the warehouse next 
door to the hospital. Luckily this release was stopped relatively quickly. However, that may not be the case in 
every situation. 

Americans have witnessed and read the news about catastrophic events at chemical facilities like the 
massive explosion last year at the West Fertilizer Company in West, TX that killed fifteen people and injured 
hundreds more by destroying a nursing home, an apartment complex, schools, and private homes. Or like the 
fire at the Chevron refinery in Richmond, CA that made thousands of people ill. Events like these have brought 
acute national attention to the danger of chemical facilities and the need to prevent catastrophic events 
caused either by accident or by the intentional actions of terrorists. 

The Chemical Facility Anti-Terrorism Program (CFATS) was intended to be an interim measure when 
the 109th Congress passed legislation providing the Department of Homeland Security (DHS) with statutory 
authority to regulate chemical facilities for security purposes. Since that time subsequent Congresses have 
continued to extend the authority to DHS for the CFATS program through appropriations. These 
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appropriations have not addressed recognized problems within the implementation and scope of the CFATS 
program and have instead allowed an inadequate status quo. Moving forward with a legislative path must 
address these recognized problems within CFATS in order to protect the millions of workers and community 
members who are now at risk. 

There are ongoing activities within the federal government related to the implementation of CFATS 
and, more broadly, to the prevention of releases, fires and explosions at chemical facilities. USW encourages 
you to include the recommendations and outcomes of the following activities and prior legislative efforts as 
you consider a legislative path forward for the CFATS: 

• In a March 2013 report, the Office of Inspector General (OIG) found that the program continued to 
face implementation challenges in the areas of submission tools and processes, representation and 
oversight, human capital, and fiscal stewardship.^ OIG made 24 recommendations to improve 
implementation of the CFATS program. 

• President Obama's Executive Order (EO) 13650 on Improving Chemical Facility Safety and Security 
requires DHS participation in a working group to improve operational coordination with state and local 
partners; enhance federal agency coordination and Information sharing; modernize policies, 
regulations and standards; and work with stakeholders to identify best practices.^ A status report is 
due to the president in May that will include the working group's recommendations for implementing 
and updating CFATS, among other things, to better prevent catastrophic Incidents. 

• During the 111^^ Congress, the House passed HR 2868, the "Continuing Chemical Facilities 
Antiterrorism Security Act of 2010." USW and other unions supported that legislation which would 
have solved many of the recognized problems in CFATS by: 

o requiring all covered facilities to make plans for the use of technologies that reduce the 
potential consequences of an attack; 

o authorizing the government to require implementation of such plans, where technically and 
economically feasible, at those facilities that present the greatest release risk; 

o mandating employee training and participation In plant security, including in compliance 
Inspections; 

o allowing states to set more protective standards; 

o allowing workers and communities to enforce protections through citizen suits against 

government agencies and by petitioning agencies for enforcement against individual facilities; 
and 

o requiring the government to report on enforcement and compliance so the public can know the 
law is being implemented, while avoiding publication of the vulnerabilities of individual 
facilities. 


^ http://www,oig.dhs.gov/assets/Mgmt/2013/OiG_13-55_Marl3.pdf 

^http://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-fadlitY-safetY'and-securitY 
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A legislative path forward needs to address the inherent weaknesses of CFATS, five of which of which I 
will cite in detail today: 

First, CFATS coverage does not extend to chemicals shipped or stored outside of a facility's fence line in 
nearby rail yards or elsewhere that may have little or no security measures. Currently CFATS does not prevent 
or document this type of risk shifting from one location to another. I have seen pictures and gotten accounts 
from our members of rail cars full of hazardous chemicals parked for days outside the fence line within yards 
of a busy road near homes and other businesses. Employers may engage in this practice to be taken off the list 
of high-risk facilities, or risk shifting could be an established practice occurring for years because workers and 
management do not recognize the hazard and the potential for a criminal act. Under CFATS there is no way of 
knowing if and how these risks are being shifted, which leaves communities in danger, DHS claims that "more 
than 3000 facilities removed, reduced, or modified holdings of chemicals of interest" but maintains no 
information as to how these reductions In holdings were achieved.^ The program does not know or track 
whether the risk was shifted. 

Second, DHS is prohibited from requiring a CFATS-covered facility to use any "particular security 
measure" including a fence in a particular area, a specific control on a unit, or any other measure that is well 
documented through past practice in the industry to prevent catastrophic incidents. This capacity building 
measure would require covered facilities to conduct a structured review of options that avoid catastrophic 
chemical hazards in well-documented assessments and plans that are reported to DHS. My colleagues and I 
work with employers every day. Many take safety measures that go above and beyond, but there are always 
some that will only do the minimum required by law and, as we all know, some who refuse to even do the 
minimum required. 

Third, CFATS should develop and promote the most effective means of reducing a catastrophic 
chemical incident, which is reducing the potential consequences by using safer chemical processes. DHS,** ERA® 
and the US Chemical Safety Board® have all highlighted the effectiveness of assessing and, where feasible, 
Implementing safer alternatives at high risk facilities. Some companies have shifted to safer processes or 
reduced their inventory of hazardous chemicals so they are no longer listed as high risk. In fact, according to a 
report from DHS to the Coalition to Prevent Chemical Disasters, since the inception of the CFATS program 
nearly 1300 facilities have completely removed their Chemicals of Interest and approximately 600 no longer 
possess a Chemical of Interest at the threshold that requires submission of a Top-Screen to DHS. But many 
companies will never even look into innovating with safer chemical processes without a legal requirement to 
do so. Legislation that passed the House In the 111*^ Congress included the requirement that CFATS-covered 
facilities "assess alternatives, in particular 'the technical feasibility, costs, avoided costs (including liabilities), 


^ http://www.dhs.gov/sites/default/files/pubiications/CFATS%20Update_Febru3ry2014.pdf 

''http://www.dhs.gov/news/2011/03/30/written-testlmony-nppd-house-committee-energy-and-commerce-hearing'titled-hr-908 
® http;//www.epa.gov/ocir/hearings/testimony/lll_2009_2010/2010_0728_ccd.pdf 
® http://www.nytimes.com/20i4/01/29/opinion/the-next-accident-awaits.html?smid=pi-share&_r=0 
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personnel implications, savings, and applicability of implementing each method to reduce the consequences 
of a terrorist attack'."’^ Safer chemical processes can include a range of controls including: 

• Reducing the quantity of hazardous material or energy; 

• Substituting a hazardous material or process with an alternative that reduces the hazard; or 

• Simplifying a process by using automation, sensors, alarms, automatic shutdowns, improved 
operating procedures, and changed equipment design.® 

Fourth, the Personnel Surety Program (PSP) under CFATS has the potential for unintended 
consequences. Many have expressed concerns about duplication of efforts and the burden for multiple 
background checks. The Transportation Worker Identification Credential (TWIC) is an option to use under 
CFATS. Many of our members have successfully obtained a TWIC card, but it is not without concerns about the 
burden on workers to obtain them and the burden on industry to install readers when the Coast Guard has not 
issued a final rule for TWIC readers. 

Another concern about the PSP is that, within the current context of the CFATS program, individual 
chemical facilities are responsible for clearing workers under their PSP. CFATS does not prevent the collection 
of unnecessary personal employee data by employers or third parties that may be full of inaccuracies due to 
errors in reporting. There is not an adequate appeals process for workers who are wrongly discriminated 
against during the PSP process. In a February 3, 2014 Federal Register notice, DHS stated that employment 
decisions based on background checks are outside of the scope of CFATS and that DHS expects employers to 
comply with applicable federal, state and local law regarding employment and privacy.® Workers are seeing 
DHS apathy about their jobs play out in facilities across the country. In fact, one of our local unions recently 
received a letter from their employer that said, "Although [COMPANY NAME] and its representatives are not 
required to notify its employees or union leadership of this requirement prior to conducting background 
investigations, we believe it is a prudent and a good business practice to do so." Not all employers will do the 
right thing by telling their empioyers about new security measures without a requirement by DHS to do so. On 
the whole this Is inadequate. Workers need to be informed about new security measures, including 
background checks being performed on them, and workers need an appeals process should they be unjustly 
disqualified from their job due to an employer-conducted background check. 

This brings me to my fifth point. CFATS lacks the requirement for a meaningful role for workers in 
chemical security. It is our observation that DHS stakeholder engagement with industry is very productive. 
However, DHS does not adequately engage workers and their representatives at either the federal level or 
within a facility. Workers who operate and maintain chemical facilities know the most about what needs to be 
done to reduce vulnerability and protect against a terrorist attack. They would be hurt first and worst in an 
attack on a facility, and therefore have the largest stake in ensuring safety. CFATS should require meaningful 


’ HR 2868 - Congress. http;//beta, congress.gov/biil/lllth-congres5/house-blil/2868 

® Atay and Komosinsky. (2012) Inherently safer technology implementation - Risk reduction and risk shifting. New Jersey Department 
of Environmental Protection. Prepared for presentation at s"* Global Congress on Process Safety. 

^ http://www.gpo.gov/fdsys/pl^/FR- 2014-02 -03/pdf/2014-02082.pdf (page 6436) 
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involvement of plant employees in developing security plans and provide whistleblower protections for those 
who engage in the process in any way including by reporting a security vulnerability either to their employer 
or to DHS. At a very minimum this could help DHS Identify facilities that are covered by CFATS but are not 
complying with its requirements. DHS should also be required to include an employee representative when 
the agency visits a facility. The Occupational Safety and Health Administration^® and the Environmental 
Protection Agency^^ both have policies that could be used as a model for DHS to include workers in 
inspections. 

Any legislation authorizing the program must be responsive to the Identified shortcomings and 
challenges of CFA13, the oversight recommendations, and other activities at the federal level regarding the 
CFATS program. Congress should not merely require more metrics from an inadequate program when there is 
consensus about problems in the program, legislative action based the recommendations from OIG, the EO 
Working Group, and other stakeholders is necessary to address the gaps in CFATS that leave millions of 
American workers and communities at risk. 

Thank you again for the opportunity to testify today. 


https://www.osh3.gov/Firm_osha_data/l(XK)06.htfnl 
“ http;//www.epa.gov/compli3nce/resources/po!icies/monitoring/caa/caall2r-rmpguide.pdf 
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Introduction: 

Chairman Carper, Ranking Member Cobum and members of the Committee, my name is Tim 
Scott and I’m the Chief Security Officer of The Dow Chemical Company. I’m speaking today on 
behalf of Dow and the American Chemistry Council, the nation’s chemical industry trade group. 

The chemical industry is an extremely diverse sector of the global economy which provides a 
broad range of products and services that improve the quality of life around the world. Some of 
essential products include chemicals that provide clean drinking water, medicines and medical 
products, fertilizers for the farming industry, key components and chemicals for use in the high 
tech manufacturing industry, light weight composite materials for use in the airline and 
transportation industries and critical items designed for top secret military applications. The 
chemical industry is a multi-billion dollar enterprise that provides high paying jobs and is 
growing. Chemical manufacturing is returning to the United States due to a boom in domestic 
natural gas production, increasing the number of well-paying paying jobs for American families 
and making the U.S. a global competitor once again. 

An essential element for success of the business of chemistry is ensuring the security of our 
products and information and our people and the communities where we operate. For members 
of the ACC, the Responsible Care Program provides the framework and foundation for managing 
security risk across an organization by providing an integrated approach that encompasses all 
aspects of the chemical supply chain: (1) Physical Plant Security, (2) Cyber and IT Security, and 
(3) Transportation / Value Chain Security, When treated as a system, an organization can 
implement a comprehensive approach to managing security risk by looking at vulnerabilities 
across the organization in a holistic way, and developing sound solutions that minimize the risks 
while maximizing the value of the business operation and protecting the critical assets of the 
company. 

Within months of the terrorist attacks of 9/1 1, ACC created a stringent, mandatory security 
program called the Responsible Care® Security Code. To date, ACC member companies have 
invested nearly $13 billion to further enhance site, transportation, and cyber security at their 
facilities under the Security Code, which has become a gold standard for the industry and serves 
as a model for regulatory programs. Core elements of the Security Code include: 

Cybersecurity. 

Recognize that protecting information and information systems is a critical component of a 
sound security management system. Assess cyberseeurity vulnerabilities and implement 
enhancements. Incorporate cybersecurity into training, drills and guidance, and all aspects of a 
Plan-Do-Check-Act security system. Take steps to protect against intrusion into facility systems 
and the diversion of products. 
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Facility Security: 

Conduct comprehensive site security vulnerability assessments using recognized methods, such 
as the Sandia National Laboratories, Chemical Security Vulnerability Assessment Methodology, 
Implement and continuously improve site security measures within a well-defined timeline. 
Document security management programs, processes, and procedures. 

Transportation/Supply Chain Security: 

Conduct vulnerability assessments throughout the supply chain and implement security 
measures, including screening of transportation providers. Working with commercial partners to 
assess transport routing and monitor shipments. Secure access to transportation/distribution 
facilities. 

Federal Security Programs and CFATS: 

In addition to enhancing security through strong industry initiatives such as Responsible Care, 
ACC and its members support an array of federal programs currently in place that give multiple 
agencies the authority to take a smart approach to regulating chemical security, while minimizing 
the burden on its operations. Some of the key Agencies and programs include: 

• The DHS Chemical Facilities Anti-Terrorism Standards. 

• The Coast Guard Maritime Transportation Security Regulations. 

• The TSA Rail Transportation Security Rule. 

• The DOT Hazardous Transportation Security Plan. 

• The CBP Customs and Transportation Partners against Terrorism. 

Under these programs, the regulated community must submit security plans for review and 
approval and be subject to rigorous site inspections. Several agencies have the authority to fine 
or shut down a facility if it fails to be in compliance. ACC is committed to working with 
regulators to make these programs more effective and efficient through improved 
implementation and better use of private and public sector resources. 

In 2006, ACC helped lead the charge in Congress to pass legislation to give the Department of 
Homeland Security (DHS) the authority to create CFATS, the Chemical Facilities Anti- 
Terrorism Standards. This stringent DHS program regulates security for a wide variety of 
chemical facilities that make, store, or use chemicals, including chemical manufacturers, farmers, 
hospitals and universities. CFATS allows facilities to tailor their security plans to meet their 
unique needs while providing DHS with clear authority to fine or shutdown facilities that do not 
meet the program’s comprehensive security standards. 

When DHS was given the authority to regulate chemical industry security, ACC and our 
members was an active and enthusiastic partner in the development of the risk-based 
performance standards model that is in place today. The ACC Responsible Care Security Code 
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is aligned in many areas and is a mandatory requirement for ACC membership. The launch of 
DHS, CFATS and the Responsible Care Security Code is a successful example of what defines a 
partnership - everyone working together on a common goal, to defeat a common foe. Despite 
some challenges along the way, we believe that CFATS has turned the comer and is moving in 
the right direction. The quality of inspections has vastly improved. The pace of implementation 
has picked up significantly and the partnership is working once again. The end result is that 
progress is being made and the security of the chemical industry is stronger today, more than 
ever before. 

I would like to point out what Dow Chemical alone has done in terms of capital investments and 
security upgrades in an effort to lead the industry in compliance with the CFATS program. Dow 
has spent approximately $250 million on security systems to ensure our facilities are as safe and 
secure as they can reasonably be and we have completed vulnerability assessments, audits and as 
needed security upgrades at our facilities worldwide - not just those regulated under CFATS in 
the US, We did this in part because we have a duty to our shareholders, employees, and 
communities but also because we find the CFATS program a good model - in harmony with the 
Responsible Care Security Code — to secure our facilities. It’s my understanding that Dow is the 
only chemical company to achieve SAFETY Act designation from DHS for both our site security 
and our distribution system security processes. 

There have been many positive developments over the last few months for CFATS - with the 
most significant being the progress toward multi-year authorization. A multi-year authorization 
puts DHS and CFATS closer in line to the industry’s capital planning process, and allows for 
some certainty for industry to take action. A multi-year authorization also brings stability to 
DHS - in planning and implementing CFATS and also staffing to be sure the necessary expertise 
is in place - and will remain in place - to accomplish the mission. 

Maintaining the original premise of a risk-based performance standards model approach, which 
permits individual sites the flexibility to determine the local solution that will meet the standards, 
also spurs progress. No two sites are the same, but ail must meet the same goal. This flexibility 
allows each unique site the flexibility to take individual ownership and identify the solution that 
meets the performance standard in the best manner possible for that site. 

We are not done - industry is not done - DHS is not done - and Congress is not done. We are 
making progress, but more needs to be done. We need to fine tune the personnel surety process 
so that it adds value to all concerned. We need to ensure that risk is being determined in a fair 
and consistent manner. We need to ensure transparency about the people at the site who have 
access to sensitive areas and the transparency about the risk they are working so hard to mitigate. 
And we need to leverage the plethora of industry security programs that are in place today, such 
as the ACC Responsible Care Program. Put together, all these goals will establish a sound 



96 


regulatory framework that will ensure the security of our nation’s chemical infrastructure for 
decades to come. 

Communication has between DHS and the sites, but we need to do more - there are still some 
barriers there. DHS field Inspectors need to be viewed as an equal partner working together to 
defeat terrorism. We need to give the inspectors the training and resources they need so they can 
ensure compliance and they understand the regulations, understand how the industry works, and 
understand the sites in their area of responsibility, and visit those sites on a regular basis. And 
industry needs to challenge our peers - we need to self-regulate both upstream and downstream 
along the supply chain and especially those in our own back yard. 

CFATS is making the chemical industry more secure, today. DHS is maturing and finding its 
way in reaching its goals. Industry is doing its share by partnering with the government at the 
federal and local levels. A multi-year reauthorization and a commitment to continue the 
partnership in a risk-based approach is essential. Just as important, we need to bring all the 
players to the table - we’re not there yet on either the public or private sector sides. We’re 
encouraged by the progress that is being made, but we need your help in maintaining the forward 
momentum. 
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Thank you for the opportunity to submit written testimony for the Chemical Facility Anti- 
Terrorism Standards (CFATS) Program hearing on May 14, 2014 entitled, “Charting a Path 
Forward for the Chemical Facilities Anti-Terrorism Standards Program” held before this 
committee. For more than 90 years, SOCMA has been and continues to be the leading trade 
association representing the specialty chemical industry. SOCMA’s more than 220 member 
companies employ more than 100,000 workers across the country and produce some 50,000 
products - valued at $60 billion annually - that help make our standard of living possible. Over 
80% of SOCMA’s members are small businesses and many are covered by the CFATS program. 

As we have testified multiple times before this committee and committees in the House, 
SOCMA strongly supports the CFATS program, and we are wholly supportive of current 
legislative efforts to shore up the program with a multi-year funding extension. The program 
requires chemical facilities nationwide to develop security enhancements, and its performance- 
based approach protects facilities against attack without impairing the industry’s ability to 
remain innovative. SOCMA member companies covered by CFATS take the security of facilities 
and products very seriously, as well as the safety of employees and communities. SOCMA 
member companies that implement responsible stewardship programs such as ChemStewards 
want a stable and predictable CFATS program. 

SOCMA recognizes that years ago the CFATS program went through a difficult period of 
administrative challenges, not unlike many new regulatory programs; however, as a result of the 
chemical sector’s strong cooperation with DHS, there has been significant improvement in the 
program. There has been 100% compliance by industry with the requirements to submit Top- 
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Screens, Security Vulnerability Assessments, and Site Security Plans or Alternate Security Plans, 
For its part, DHS is making good progress in implementing the reforms identified by Director 
David Wulf, with oversight from Congress. SOCMA member companies report positive 
experiences with authorization inspections and especially are appreciative that DHS responded to 
a SOCMA request to develop a resource called “What to Expect from the Inspectors” explaining 
what companies should anticipate for final authorizations. This is a good example of chemical 
companies wanting to do the right thing, and DHS working well with us for compliance to meet 
mutual goals. 

The CFATS program is working. It is important to underscore the fact that CFATS is driving 
facilities to reduce inherent hazards relying not on federal regulatory mandates, such as one to 
impose inherently safer technology. Since the program was launched in 2007, CFATS has 
driven nearly 3,000 facilities nationwide to reduce inherent hazards, where in their expert 
judgment doing so makes economic sense, is in fact safer, and does not transfer risk to some 
other point in the supply chain. Thus, CFATS is reducing risks in a market-based way. 

Furthermore, DHS is nearing the completion of 1,000 site security plan approvals, which include 
plans from facilities among the highest of the high-risk tiers. The collaborative quality of the 
work being conducted between the agency and specialty manufacturers in authorization 
inspections is remarkable for meeting shared, mutual goals of enhancing security at our chemical 
facilities. The agency appears to be making every effort to assist small businesses who are eager 
to find favorable solutions to meet regulatory requirements that fit the needs of the specific 
company. These authorization inspections are a good model for how government should work 


3 



100 


with businesses to meet common goals. These are not hasty approvals; they are simply working 
well together to get the job done and, in fact, DHS is on target to complete many of the goals of 
the program in a shorter time frame than originally expected. 

Without ignoring the opportunity to improve DHS’s implementation of CFATS, it is important to 
note the successes of the program. To a great extent, the CFATS rules faithfully implement the 
statutory mandate issued by Congress in 2006. CFATS is a comprehensive, appropriately risk- 
based regulation that avoids being overly prescriptive, yet also has teeth — the Secretary has the 
authority to shut down a facility for non-compliance. Furthermore, covered facilities have 
invested billions of dollars to upgrade security and meet CFATS’s requirements. 

Now it is time for Congress to act. After numerous oversight hearings in the House and Senate 
during the past several years that have publicly documented DHS’ progress without uncovering 
flaws in the standards themselves. Congress needs to ensure CFATS’s continued stability by 
properly establishing it as a program through Homeland Security, and through a longer-term 
authorization and funding cycle. Additionally, SOCMA would like the program to permit 
facilities to satisfy their obligation to help screen employees and visitors for terrorist ties if the 
facilities rely on federal credentials that are vetted against the terrorist screening database - 
without having to supply any other information to DHS. These legislative changes to the 
program would provide significant stability for the program. These changes already have bi- 
partisan support, as evidenced by the support of H.R. 4007, “The CFATS Authorization and 
Accountability Act of 2014” that was recently passed by the House Committee on Homeland 
Security and may soon be voted on by the full House. 
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Congress continues to miss an opportunity to provide regulatory certainty for the private sector 
and DHS alike by not authorizing CFATS on a multi-year basis. We cannot and should not 
continue down the current path of temporary extensions and one-year appropriations riders, nor 
can we afford to throw the baby out with the bathwater by defunding or abolishing this critical 
program. If Congress halts the program, it would immediately throw the security efforts of 
thousands of facilities into limbo, waste millions of dollars, and create a major setback to the 
public’s justifiable expectation that industry and government work together to secure chemicals 
produced or stored by CFATS facilities. 

As Kate Donahue, President of Hampford Research, a SOCMA member company, testified to a 
House subcommittee in February that programmatic disruptions and regulatory uncertainty are 
things Congress should do its best to avoid. “Even under ideal circumstances, it costs companies, 
especially small businesses, time and money to plan for, pay for, prepare for, and clear days off 
calendars of multiple employees to comply with a program like CFATS,” Donahue testified. 

“We want a stable and predictable program.” 

SOCMA urges Senator Carper and Senator Coburn to consider and propose a legislative measure 
similar to H.R. 4007, “The CFATS Authorization and Accountability Act of 2014,” and to work 
together with your colleagues in the House to find a way forward to providing the stability and 
regulatory certainty for which SOCMA members are asking and need. 
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Post-Hearing Questions for the Record 
Submitted to Hon. Suzanne Spaulding and David Wulf 
From Senator Carl Levin 

“Charting a Path Forward for the 
Chemical Facilities Anti-Terrorism Standards Program” 
May 21, 2014 


Question#: 

1 

Topic: 

CFATS 1 

Hearing: 

Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards 

Program 

Primary: 

The Honorable Carl Levin 

Committee: 

HOMELAND SECURITY (SENATE) 


Question: The August 2013 Executive Order on Improving Chemical Facility Safety and 
Security directs the agency to assess how chemical security could be improved, 
including: 

Coordinating more effectively with State, Local and Tribal partners, including first 
responders; 

Coordinating more effectively with other federal agencies to identify non-responders to 
the CFATS (Chemical Facilities Anti-Terrorism Standards) program; and 

Sharing information about best practices concerning the use of safer chemicals and 
processes. 

When will DHS finalize those assessments, and will they be made available to the 
regulated community and/or the public? 

Response: On June 6, 2014, the Department of Homeland Security, the Department of 
Labor, and the Environmental Protection Agency released a report entitled Actions to 
Improve Chemical Facility Safety and Security - A Shared Commitment. The report, 
which was developed by the working group established under Executive Order (EO) 
13650, summarizes both the actions taken by the Federal government since the issuance 
of EO 13650 (many of which involved collaboration with other chemical facility safety 
and security stakeholders) and future activities planned to enhance chemical facility 
safety and security. The report contains sections on “Enhancing Federal Operation 
Coordination”, “Improving Data Management”, and “Modernizing Policies and 
Regulations”, among others, which include discussions on the Federal interagency 
working group’s findings related to more effective coordination with State, local, 
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Question#: 

i 

Topic: 

CFATS 1 

Hearing: 

Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards 

Program 

Primary: 

The Honorable Carl Levin 

Committee: 

HOMELAND SECURITY (SENATE) 


territorial, and tribal partners; enhancing Federal coordination to identify potential non- 
responders; and sharing best practices. 
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Question#: 

2 

Topic: 

CFATS 2 

Hearing: 

Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards 

Program 

Primary: 

The Honorable Carl Levin 

Committee: 

HOMELAND SECURITY (SENATE) 


Question: Although facilities with greater than threshold quantities of chemicals of 
interest are required to submit information to DHS, some facilities do not provide such 
information. This situation was brought to light in April 2013 when an explosion 
occurred at a fertilizer plant in West, Texas, killing 15 people (12 first responders and 3 
residents) and injuring 200 people. Although this facility had 40 to 60 tons of ammonium 
nitrate at the facility (more than the DHS threshold amount), it had never reported this 
information to DHS and was not complying with any of the Chemical Facilities Anti- 
Terrorism Standards Program (CFATS) requirements. 

Under current law, DHS can issue orders requiring a facility to come into compliance. If 
the facility is unresponsive, then DHS can issue penalties, which include closing the 
facility. At the May 14 hearing, Director Wulf stated that DHS thinks it has the power to 
issue fines to nonresponsive facilities. 

Could such a fine be issued only after DHS orders a facility to register under CFATS, and 
the facility then did not register? 

Response: Under Section 550 of the Homeland Security Appropriations Act of 2007, the 
Department must provide the owner or operator with written notification and issue an 
order to comply by such date as the Secretary determines to be appropriate under the 
circumstances. The Secretary may assess civil penalties only if the facility violates an 
order. 

Question: Could such a fine also be issued to a nonresponsive facility that DHS 
identified and which subsequently registered after DHS ordered it to do so? 

Response: If DHS issued an order requiring a facility to file a top screen' with DHS and 
the facility filed the top screen within the time frame contained in the order, then the 
Department would not have the authority to assess civil penalties for the initial 
noncompliance; however, if the facility violated that order by not filing a top screen until 
after the expiration of the timeframe contained within the order, then the Department 
would have the discretion to assess civil penalties despite the facility’s subsequent 
compliance. 


" A top screen is an initial screening process designed by the Assistant Secretary through which 
chemical facilities provide information to the Department for use pursuant to § 27.200 of these 
regulations. See reference: 6CFR 27.105 
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Question#: 

2 

Topic: 

CFATS 2 

Hearing: 

Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards 

Program 

Primary: 

The Honorable Carl Levin 

Committee: 

HOMELAND SECURITY (SENATE) 


Question: If DHS cannot issue fines to nonresponsive facilities that subsequently register 
after DHS identifies the facility and then orders it to register, would DHS support 
legislation that would penalize facilities that are required to register with DHS but fail to 
do so? 

Response: DHS would support legislation that would give the Department the 
discretionary authority to penalize facilities that are required by regulation to file top 
screens with DHS and have not complied. As noted in Actions to Improve Chemical 
Facility Safety and Security - A Shared Commitment, the Report developed by the 
Federal working group under EO 13650, the Department is committed to working with 
Congress to pursue action to streamline the CFATS enforcement process to allow DHS, 
in extreme circumstances, to immediately issue orders to assess civil penalties or to close 
down a facility for violations, without having to first issue an order calling for correction 
of the violation. 

Question: Has DHS taken a position on the late Senator Lautenberg’s legislation (S. 814) 
that would provide for stronger penalties for violations of CFATS? 


Response: No. 
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Question: Under CFATS, chemical facilities are required to conduct background checks 
on employees and unescorted visitors and provide identifying information to DHS for use 
in screening employees against the Terrorist Screening Database (TSDB), DHS is still in 
the process of finalizing how facilities ensure that individuals with known terrorist 
affiliations do not gain access to high-risk facilities. 

If DHS finds that the name of a person submitted by a chemical facility to DHS matches 
a person on the Terrorist Screening Database, will DHS inform the chemical facility? 

If DHS does not inform the chemical facility of a TSDB match, why does DHS withhold 
such information? 

Response: To prevent a significant threat to a facility or loss of life, a high-risk chemical 
facility will be contacted where appropriate and in accordance with federal law and 
policy, as well as law enforcement and intelligence requirements. 

Question: Is there a way for a person to learn whether he or she has not been hired or has 
been fired because of a TSDB issue? Is there any way for this individual to appeal the 
TSDB finding by DHS? 

Response: CFATS does not regulate the hiring or firing process, and DHS will neither 
require nor recommend that facilities hire, fire, or refuse to hire any individuals because 
of TSDB vetting results. Furthermore, DHS will not maintain any records about 
facilities’ hiring or firing practices. 

Once DHS begins collecting information on individuals for vetting against the TSDB 
under the CFATS program, if an affected individual raises questions about the accuracy 
of the vetting information submitted to DHS by a high-risk chemical facility, the 
Department will recommend that the individual contact the facility in question to request 
that the submission be updated with correct information. If a high-risk chemical facility 
is unable to, or refuses, to correct inaccurate or erroneous information, the affected 
individual may also contact DHS to have inaccurate or erroneous information corrected. 

Pursuant to 6 CFR 27.310(a)(1), an affected individual will also be able to institute 
formal proceedings to contest a finding by DHS that he/she is a potential security threat. 
The procedures for such formal proceedings are described in Subpart C of the CFATS 
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regulations, 6 CFR 27.300 - 27.345. Administrative Law Judges will preside over any 
such proceedings. 
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Question: To increase the number of site security plans reviewed and approved and the 
rate of chemical facility inspections, DHS is considering the use of third-party inspectors. 

How would the use of third-party inspectors by DHS impact the security of our nation? 

Are inspections of our nation’s highest risk chemical facilities an inherently 
governmental function? 

Response: At this time, DHS is not actively pursuing the use of third-party inspectors. 
DHS intends to issue an Advance Notice of Proposed Rulemaking regarding the CFATS 
regulations to solicit public input on possible program changes to CFATS, through which 
the public could comment on the notion of using third-party inspectors for CFATS 
inspections. As part of any analysis of the potential utility of and various structures for 
third-party audit programs, however, the Department would assess both the impact of the 
use of third-party inspectors on the security of our nation and the question of whether 
CFATS inspections are an inherently governmental function. 
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Question: GAO found that DHS’s assessment of chemical facility risks was flawed. 

Some of the flaws GAO found included the fact that DHS did not consider economic 
consequences, was using old data, and did not consider vulnerability differences across 
facilities. In February 2014, DHS reported that it was revising its risk assessment process 
to address the issues GAO identified, and should complete these revisions within the next 
12 to 18 months. 

Is DHS still on track to finalize its revised risk assessment to address the problems 
identified by GAO by August 2015? 

Response: Yes. 

Question: Will the revised risk assessment be used by DHS to evaluate all chemical 
facilities that have submitted a Top-Screen, or only those facilities that will in the future 
submit a Top-Screen or have not yet been assigned to a risk tier? 

Response: The Department has not yet made a decision regarding the applicability of the 
revised risk assessment to previously assessed facilities and is in the process of assessing 
various options related to that issue. 

Question: If DHS only uses the revised risk assessment on facilities that have not yet 
been assigned to a risk tier, would this mean that some facilities are incorrectly assigned 
to risk tiers? In other words, would some facilities that DHS previously identified as 
being lower risk (meaning that they were not assigned to one of the 4 high risk tiers) 
actually be high risk if the revised risk assessment method were used? Will DHS re- 
evaluate these so-called lower risk facilities using the revised risk assessment method? 

Response: The Department has not yet made a decision regarding the applicability of the 
revised risk assessment to previously assessed facilities and is in the process of assessing 
various options related to that issue. 

Question: What plans does DHS have to re-evaluate all chemical facilities that have 
registered through their Top-Screen submission to ensure the facilities are assigned to the 
correct risk tier? 




110 


Question#: 

5 

Topic: 

GAO 

Hearing: 

Charting a Path Forward for the Chemical Facilities Anti-Terrorism Standards 

Program 

Primary: 

The Honorable Carl Levin 

Committee: 

HOMELAND SECURITY (SENATE) 


Response: The Department has not yet made a decision regarding the applicability of the 
revised risk assessment to previously assessed facilities and is in the process of assessing 
various options related to that issue. 
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